chore(cf-tunnels): drop cluster_apps resource — operator owns it

[xnoto]

Summary

The cloudflare_zero_trust_tunnel_cloudflared.cluster_apps resource was a stub that held the import-time tunnel ID under lifecycle { ignore_changes = all } — it didn't actually manage anything. The real owner of that tunnel is now cloudflare-operator, via the ClusterTunnel CR in kustomize-cluster/operators/cloudflare/cluster-tunnel.yaml.

This drops the dead resource block plus its (unused) tunnel_ids.cluster_apps output.

Important — operator action required before `apply`

The resource is still in this root's TF state pointed at the legacy cluster-apps-crc tunnel ID 1ac3a39c-7d97-422e-88e5-1f82b6334bbb. After merge, the operator must pick one of:

Option 1 — preserve the legacy tunnel in Cloudflare (just stop tracking it):

tofu state rm cloudflare_zero_trust_tunnel_cloudflared.cluster_apps

Then tofu plan is clean, no resources change. Delete the orphan tunnel manually from the Cloudflare dashboard whenever convenient.

Option 2 — let TF destroy the legacy tunnel:

tofu apply

TF will destroy 1ac3a39c-… (the orphan). Safe because no DNS records or active workloads reference it — the new operator-managed tunnel cluster-apps-k3s (created by the kustomize-cluster ClusterTunnel CR) gets a fresh ID and the operator reconciles DNS to point at it.

Either is fine. Option 2 is tidier; Option 1 is the cautious choice if you want to verify the new tunnel is fully serving traffic before retiring the orphan.

Test plan

• After merge + chosen apply path: tofu plan shows no changes
• No regressions on already-working FQDNs (e.g., warp connector unaffected)

🤖 Generated with Claude Code

[github-actions]

OpenTofu Plan

OpenTofu will perform the following actions:

  # cloudflare_zero_trust_tunnel_cloudflared.cluster_apps will be destroyed
  # (because cloudflare_zero_trust_tunnel_cloudflared.cluster_apps is not in configuration)
  - resource "cloudflare_zero_trust_tunnel_cloudflared" "cluster_apps" {
      - account_id        = (sensitive value) -> null
      - account_tag       = "03f750691b4ad4d59aa4b7205adaa108" -> null
      - config_src        = "local" -> null
      - connections       = [] -> null
      - conns_inactive_at = "2026-02-21T03:38:29Z" -> null
      - created_at        = "2025-12-31T18:14:55Z" -> null
      - id                = "1ac3a39c-7d97-422e-88e5-1f82b6334bbb" -> null
      - metadata          = jsonencode({})
      - name              = "cluster-apps" -> null
      - remote_config     = false -> null
      - status            = "down" -> null
      - tun_type          = "cfd_tunnel" -> null
    }

Plan: 0 to add, 0 to change, 1 to destroy.

Changes to Outputs:
  ~ tunnel_ids = {
      - cluster_apps = "1ac3a39c-7d97-422e-88e5-1f82b6334bbb"
        # (1 unchanged attribute hidden)
    }