feat(cluster): add Kubernetes API DNS record

[xnoto]

Summary

• add api.makeitwork.cloud to the proxied CNAMEs for the operator-owned cluster-apps-k3s tunnel
• document direct Dex OIDC kubectl access
• retain the Access-gated k3s.makeitwork.cloud TCP route during migration

Validation

• canonical tfroot pre-commit suite
• OpenTofu validate, tflint, Checkov, fmt, terraform-docs, and Gitleaks passed
• only the expected no-commit-to-branch hook failed locally because the repository started on main

Rollout

Merge this PR before the paired kustomize-cluster route PR.

[github-actions]

OpenTofu Plan

OpenTofu will perform the following actions:

  # cloudflare_dns_record.cluster_apps["api"] will be created
  + resource "cloudflare_dns_record" "cluster_apps" {
      + content          = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com"
      + created_on       = (known after apply)
      + id               = (known after apply)
      + meta             = (known after apply)
      + modified_on      = (known after apply)
      + name             = "api"
      + proxiable        = (known after apply)
      + proxied          = true
      + settings         = (known after apply)
      + tags             = (known after apply)
      + tags_modified_on = (known after apply)
      + ttl              = 1
      + type             = "CNAME"
      + zone_id          = (sensitive value)
    }

Plan: 1 to add, 0 to change, 0 to destroy.