fix(cloudflare): remove OpenCode Access gate

[xnoto]

Summary

• remove the Cloudflare Access application that prevents native opencode attach from reaching the OpenCode server
• retain the proxied Tunnel CNAME; authentication is now enforced by the server via the SOPS-encrypted password

Validation

• make test

[github-actions]

OpenTofu Plan

OpenTofu will perform the following actions:
# cloudflare_zero_trust_access_application.opencode will be destroyed
# (because cloudflare_zero_trust_access_application.opencode is not in configuration)
- resource "cloudflare_zero_trust_access_application" "opencode" {
- account_id = (sensitive value) -> null
- allowed_idps = [
- "e584ea47-1251-4939-95f4-4daf4a58cd31",
] -> null
- app_launcher_visible = true -> null
- aud = "e06d181b827240bd60d422b762d292bf4e0ea00c6a001e50a8938ec7fda0ba63" -> null
- destinations = [
- {
- type = "public" -> null
- uri = "opencode.makeitwork.cloud" -> null
},
] -> null
- domain = "opencode.makeitwork.cloud" -> null
- http_only_cookie_attribute = true -> null
- id = "d444f7bc-6679-4ff8-b692-f01e5c4a56d3" -> null
- name = "OpenCode" -> null
- policies = [
- {
- decision = "allow" -> null
- include = [
- {
- group = {
- id = "e0d9e873-31d7-4536-9234-3dad8a99d84d" -> null
} -> null
},
] -> null
- name = "makeitworkcloud-admins" -> null
- precedence = 1 -> null
},
] -> null
- self_hosted_domains = [
- "opencode.makeitwork.cloud",
] -> null
- session_duration = "24h" -> null
- type = "self_hosted" -> null
}
Plan: 0 to add, 0 to change, 1 to destroy.