feat(tunnels): switch to temporary Cloudflare tunnels

Replace persistent Cloudflare tunnels (API-based) with temporary tunnels using
'cloudflared tunnel --url'. This removes the need for Cloudflare API tokens,
DNS records, and persistent tunnel management.

Changes:
- Install cloudflared binary in API Dockerfile
- Add start_cloudflared_tunnel() and stop_cloudflared_tunnel() to docker.py
- Update instance start/stop/restart/delete to use temporary tunnels
- Store tunnel PID in tunnel_id field, temporary URL in url/public_url
- Remove Cloudflare API service (cloudflare_tunnel.py)
- Remove cloudflared container from docker-compose
- Remove Cloudflare env vars (CLOUDFLARE_API_TOKEN, ZONE_ID, etc.)
- Remove Cloudflare configuration from config.py
- Remove Cloudflare startup check from main.py
- Remove /health/cloudflare endpoint

apps/api/src/main.py

@@ -229,18 +229,6 @@ async def on_startup():
 
     # Seed built-in data
     await seed_builtin_tool_types()
-
-    # Check Cloudflare configuration
-    settings = Settings()
-    if settings.cloudflare_api_token and settings.cloudflare_account_id and settings.cloudflare_zone_id and settings.cloudflare_base_domain:
-        logger.info("Cloudflare tunnel configuration detected: base_domain=%s", settings.cloudflare_base_domain)
-    else:
-        logger.warning(
-            "Cloudflare tunnel configuration incomplete. "
-            "Tunnels will not be created. Set CLOUDFLARE_API_TOKEN, "
-            "CLOUDFLARE_ACCOUNT_ID, CLOUDFLARE_ZONE_ID, and CLOUDFLARE_BASE_DOMAIN."
-        )
-
     logger.info("Startup complete.")
 
 app.include_router(health_router)