feat: add cloudflared tunnel for public service exposure

[bussyjd]

Summary

• Add Cloudflare Tunnel integration for public service exposure without port forwarding
• Uses quick tunnel mode for MVP (random trycloudflare.com URL)
• New CLI commands: obol tunnel status, obol tunnel restart, obol tunnel logs
• Tunnel deploys automatically with obol stack up

Changes

File	Description
internal/embed/infrastructure/cloudflared/Chart.yaml	Minimal Helm chart metadata
internal/embed/infrastructure/cloudflared/templates/deployment.yaml	Quick tunnel deployment
internal/embed/infrastructure/helmfile.yaml	Added cloudflared release
internal/tunnel/tunnel.go	Tunnel management functions (status, restart, logs)
cmd/obol/main.go	Added tunnel CLI commands

Usage

# Start stack (tunnel deploys automatically)
obol stack up

# Get tunnel URL
obol tunnel status

# View logs
obol tunnel logs -f

# Restart to get new URL
obol tunnel restart

Example Output

$ obol tunnel status

Cloudflare Tunnel Status
──────────────────────────────────────────────────
Mode:         quick
Status:       active
URL:          https://random-words-here.trycloudflare.com
Last Updated: 2026-01-14T12:00:00Z
──────────────────────────────────────────────────

Test with: curl https://random-words-here.trycloudflare.com/

Notes

• Quick tunnel URLs change on each restart (by design)
• Routes must be configured to allow external access (hostname-based routing)
• Future: Named tunnel support for persistent URLs (obol tunnel login)

Test plan

• obol tunnel status shows URL and status
• obol tunnel logs displays cloudflared logs
• obol tunnel restart restarts and gets new URL
• External traffic reaches Traefik via tunnel
• Local obol.stack access unaffected