Add Cloudflare traffic hardening controls

[dills122]

Summary

• Adds OpenTofu-managed Cloudflare traffic hardening for Forage hosted environments.
• Protects staging web access while keeping API OAuth flows reachable.
• Documents the Cloudflare UI, token, and plan-tier constraints discovered during deployment.

What Changed

• Added WAF geo managed-challenge rules for staging and production web/API hostnames.
• Added a Cloudflare Access application and allowlist policy for staging web.
• Added a combined /auth/* and /api/* rate-limit ruleset compatible with the current Cloudflare plan.
• Preserved existing Pages compatibility date/flags in OpenTofu to avoid unrelated Pages drift.
• Added security outputs and example tfvars.
• Updated hosting/security and IaC docs for setup, token permissions, and rate-limit limitations.

Validation

• npm run check
• npm run check:docs
• npm run infra:fmt:check
• npm run check:workspace
• tofu validate
• tofu apply
• tofu plan
• Manual staging test confirmed Cloudflare Access, GitHub OAuth, and import flow work.

Scope Notes

• Cloudflare only allows one http_ratelimit rule on the current plan.
• Rate limiting is deployed as 20 requests / 10 seconds with a 10 second block.
• WAF geo controls still use managed challenge.
• Final OpenTofu plan reported No changes.