docs(kubectl): document direct API access

[xnoto]

Summary

• document direct Dex OIDC kubectl access through https://api.makeitwork.cloud
• retain the existing Access TCP route as a migration fallback
• preserve node-local admin kubeconfig break-glass guidance

Validation

• canonical tfroot pre-commit suite
• OpenTofu validate, tflint, Checkov, fmt, terraform-docs, and Gitleaks passed
• only the expected no-commit-to-branch hook failed locally because the repository started on main

Documentation-only; merge after the Cloudflare and Kustomize rollout PRs.

[github-actions]

OpenTofu Plan

OpenTofu will perform the following actions:

  # module.k3s.libvirt_cloudinit_disk.commoninit will be created
  + resource "libvirt_cloudinit_disk" "commoninit" {
      + id             = (known after apply)
      + meta_data      = <<-EOT
            instance-id: k3s
            local-hostname: k3s
        EOT
      + name           = "k3s_commoninit"
      + network_config = <<-EOT
            version: 2
            ethernets:
              enp1s0:
                dhcp4: true
              enp2s0:
                dhcp4: false
                addresses:
                  - 192.168.102.2/24
        EOT
      + path           = (known after apply)
      + size           = (known after apply)
      + user_data      = (sensitive value)
    }

  # module.runner.libvirt_cloudinit_disk.commoninit will be created
  + resource "libvirt_cloudinit_disk" "commoninit" {
      + id             = (known after apply)
      + meta_data      = <<-EOT
            instance-id: runner
            local-hostname: runner
        EOT
      + name           = "runner_commoninit"
      + network_config = (sensitive value)
      + path           = (known after apply)
      + size           = (known after apply)
      + user_data      = (sensitive value)
    }

Plan: 2 to add, 0 to change, 0 to destroy.

[xnoto]

Rollout note: the PR validation passed, but the OpenTofu plan unexpectedly reports two unrelated creates (module.k3s.libvirt_cloudinit_disk.commoninit and module.runner.libvirt_cloudinit_disk.commoninit). This documentation-only PR will be squash-merged with [skip ci] so main does not apply that drift. Investigate the cloud-init disk plan separately before any libvirt apply.