feat: add Cloudflare MCP

[xnoto]

Summary

Adds the Cloudflare Access-protected Make IT Work Cloud MCP endpoint and changes routing guidance to prefer hosted Make IT Work Cloud MCP services over local gateway ports.

Fixes # N/A

Type of change

• Feature / enhancement
• Documentation

Validation

• Required pull-request checks pass — Lint run 34326837874 succeeded.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — no generated files changed.
• Static review verified the endpoint, environment-only Access header references, oauth: false, and retention of the default OpenCode approval posture ("*": "ask").
• Credentialed MCP initialization and a harmless Cloudflare read are deferred: Access credentials are intentionally unavailable in this session.

Impact and rollout

• Canonical source: xnoto/opencode-config; xnoto/dotfiles selects it as the ~/.config/opencode git external.
• Selection, installed-client reload, and authenticated functional verification are manual owner-run stages; no deployment or service action is included.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks
• Breaking or irreversible effects are described above with rollback notes — rollback is removal of the MCP entry and restoration of routing guidance.

AI-assisted change; independent adversarial and validation-coverage reviews completed.