feat(kubectl-tunnel): expose kube-apiserver via cluster-apps tunnel

[xnoto]

Summary

Expose the kube-apiserver as a TCP tunnel through the existing cluster-apps Cloudflare Tunnel so admins can reach `kubectl` from anywhere without VPN, without opening the apiserver to the public internet, and gated on GitHub-org-admin authentication via the Cloudflare Access app already provisioned in tfroot-cloudflare.

`workloads/kubectl-tunnel/tunnel-binding.yaml`

TunnelBinding in `default` ns referencing the `kubernetes` Service:

```yaml
subjects:

• name: kubernetes
  spec:
  fqdn: k3s.makeitwork.cloud
  protocol: tcp
  target: tcp://kubernetes.default.svc:443
  ```

`workloads/apps/kubectl-tunnel-app.yaml` + `kustomization.yaml`

Standard ArgoCD Application wiring; sync wave 1 (after gitops-operators brings up cloudflare-operator).

Pairs with

• tfroot-cloudflare fix: drop OLM artifacts blocking gitops-operators sync on k3s #6 (merged) — CNAME for k3s.makeitwork.cloud + Cloudflare Access self_hosted app gating it.

Client usage (one-time setup per laptop)

```
brew install cloudflared
cloudflared login # browser OIDC, stores cert
cloudflared access tcp \
--hostname k3s.makeitwork.cloud \
--url localhost:6443 & # backgrounded shim

kubeconfig points at the local shim

kubectl config set-cluster k3s --server=https://localhost:6443 --insecure-skip-tls-verify
```

(Use `--insecure-skip-tls-verify` only if you don't have the apiserver CA pinned; ideally embed the cluster CA cert in the kubeconfig instead.)

Test plan

• After merge: `kubectl-tunnel` Application Synced + Healthy
• After merge: `cloudflared access tcp --hostname k3s.makeitwork.cloud --url localhost:6443` opens after GitHub OAuth
• After merge: `kubectl --server=https://localhost:6443 get nodes` reaches the apiserver

🤖 Generated with Claude Code