Persist Cloudflare Tunnel hostname via login flow

[bussyjd]

Implements persistent, DNS-routed Cloudflare Tunnel setup via obol tunnel login (browser auth) with API-token provisioning as a fallback.

Key points:

• Adds obol tunnel login --hostname <fqdn> to create a locally-managed tunnel + DNS route, then configures in-cluster cloudflared using a Secret/ConfigMap.
• Keeps obol tunnel provision (API token) as a non-interactive fallback.
• Updates the embedded cloudflared chart to support local-managed + remote-managed + quick tunnel modes (auto-detected).
• Removes Gateway API HTTPRoute hostname pinning so public hostnames (quick + DNS) route correctly.

[bussyjd]

Validation (local dev)

• Ran obol stack up with the cloudflared connector running in Kubernetes (traefik namespace).
• Ran obol tunnel login --hostname <fqdn> (Cloudflare browser auth) to create a locally-managed named tunnel and DNS route.
• Verified the Cloudflare account certificate created by cloudflared tunnel login is persisted and that the in-cluster connector is able to use it:
  • The required cert + tunnel credentials are stored in the cluster Secret (traefik/cloudflared-local-credentials) and mounted into the cloudflared pod.
  • After a kubectl rollout restart deploy/cloudflared, the connector came back up in locally-managed mode (using --origincert + --config) and the tunnel stayed active (obol tunnel status remained in dns mode).
• Verified the public hostname serves the stack (HTTP 200 from the frontend) after removing Gateway API HTTPRoute hostname pinning.

Cloudflare docs references

• Create a locally-managed tunnel: https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/create-local-tunnel/
• Local tunnel configuration file: https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/configuration-file/
• Run parameters (--origincert, --config): https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/cloudflared-parameters/run-parameters/
• cloudflared tunnel route dns: https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/routing-to-tunnel/
• Remote tunnel API (fallback path): https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel-api/