CF/#1033 📄 CF-Tunnel-Mapping (SSoT) + cloudflare-MCP-Scaffold

- docs/cf-tunnel-mapping.md: Single Source of Truth zur #1033-Diagnose
  (bf-Tunnel = Round-Robin über 3 Connectors macmini/pve/NAS)
- mcp/cloudflare/: README + .env.example (echtes .env via mcp/.gitignore ausgeschlossen)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

mcp/cloudflare/.env.example

@@ -0,0 +1,22 @@
+# Cloudflare scoped API-Token — Vorlage. Echte Werte → .env (gitignored via mcp/**/.env)
+# Token-Scopes (least-privilege): Cloudflare Tunnel:Edit, DNS:Edit (Zone emsenhuber.net),
+# Access: Apps and Policies:Edit, Access: Organizations, Identity Providers, and Groups:Edit
+CF_API_TOKEN=
+
+# Feste IDs (kein Secret, hier als Referenz):
+CF_ACCOUNT_ID=393c051f3accf51881d6c98fc5b66c36
+CF_ZONE_ID=1b5bc02fdf61b6b989afde543f3f4134
+CF_BF_TUNNEL_ID=70d6a4cf-aa1d-4a91-b918-91fab4fa7270
+
+# --- OAuth-App-Secrets für Access-IdPs (von den jeweiligen Provider-Konsolen) ---
+# Callback-URL überall: https://emsenhuber.cloudflareaccess.com/cdn-cgi/access/callback
+GITHUB_CLIENT_ID=Ov23li2h96hAkGRPJXYV
+GITHUB_CLIENT_SECRET=
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
+FACEBOOK_APP_ID=
+FACEBOOK_APP_SECRET=
+
+# --- Geli ---
+GELI_EMAIL=
+GELI_PUBLIC_IP=     # optional, /32 — nur falls stabile öffentliche IPv4 (bei CGNAT leer lassen)