cloudflare-dns: config from settings, not static manifest env (ADR 0051)

Which zone, domain and ingress are a mesh's facts, not the module's — so they
are settings merged into a config file the mesh manages, read by fromEnv, rather
than the empty env placeholders I wrongly baked in. The token stays the one
own-secret. The module now describes a Cloudflare registrar; which zone is a
setting, so the same description serves every mesh. Typechecks; manifest parses.

modules/cloudflare-dns/module.json

@@ -37,6 +37,14 @@
       "path": "/var/lib/cloudflare-dns/grants",
       "mode": "0700"
     },
+    {
+      "id": "config",
+      "type": "file",
+      "path": "/var/lib/cloudflare-dns/config.json",
+      "merge": "json",
+      "content": "{}",
+      "mode": "0600"
+    },
     {
       "id": "provisioner",
       "type": "container",
@@ -47,11 +55,10 @@
         "GRANTS": "/grants",
         "MESH_CLOUDFLARE_TOKEN_FILE": "/run/secrets/token",
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_CLOUDFLARE_ZONE_ID": "",
-        "MESH_PUBLIC_DOMAIN": "",
-        "MESH_PUBLIC_INGRESS": ""
+        "MESH_CLOUDFLARE_CONFIG_FILE": "/run/config/config.json"
       },
       "volumes": [
+        "/var/lib/cloudflare-dns/config.json:/run/config/config.json:ro",
         "/var/lib/cloudflare-dns/grants:/grants",
         "/var/lib/cloudflare-dns/token:/run/secrets/token:ro",
         "/var/lib/cloudflare-dns/broker:/run/secrets/broker:ro"