feat: add Cloudflare DNS tool suite with multi-instance support

- zone-list, record-list, record-create, record-update, record-delete
- Named instance support (-a flag) with configurable default
- Zone name-to-ID auto-resolution in shared _lib.sh
- Updated credentials loader with cloudflare/cloudflare-<name> services
- TOOLS.md and INFRASTRUCTURE.md guide documentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tools/_lib/credentials.sh

@@ -10,7 +10,7 @@
 #
 # Supported services:
 #   portainer, coolify, authentik, glpi, github,
-#   gitea-mosaicstack, gitea-usc, woodpecker
+#   gitea-mosaicstack, gitea-usc, woodpecker, cloudflare
 #
 # After loading, service-specific env vars are exported.
 # Run `load_credentials --help` for details.
@@ -49,6 +49,8 @@ Services and exported variables:
   gitea-mosaicstack → GITEA_URL, GITEA_TOKEN
   gitea-usc         → GITEA_URL, GITEA_TOKEN
   woodpecker        → WOODPECKER_URL, WOODPECKER_TOKEN
+  cloudflare        → CLOUDFLARE_API_TOKEN (uses default instance)
+  cloudflare-<name> → CLOUDFLARE_API_TOKEN (specific instance, e.g. cloudflare-personal)
 EOF
     return 0
   fi
@@ -110,9 +112,25 @@ EOF
       [[ -n "$WOODPECKER_URL" ]] || { echo "Error: woodpecker.url not found" >&2; return 1; }
       [[ -n "$WOODPECKER_TOKEN" ]] || { echo "Error: woodpecker.token not found" >&2; return 1; }
       ;;
+    cloudflare-*)
+      local cf_instance="${service#cloudflare-}"
+      export CLOUDFLARE_API_TOKEN="${CLOUDFLARE_API_TOKEN:-$(_mosaic_read_cred ".cloudflare.${cf_instance}.api_token")}"
+      export CLOUDFLARE_INSTANCE="$cf_instance"
+      [[ -n "$CLOUDFLARE_API_TOKEN" ]] || { echo "Error: cloudflare.${cf_instance}.api_token not found" >&2; return 1; }
+      ;;
+    cloudflare)
+      # Resolve default instance, then load it
+      local cf_default
+      cf_default="${CLOUDFLARE_INSTANCE:-$(_mosaic_read_cred '.cloudflare.default')}"
+      if [[ -z "$cf_default" ]]; then
+        echo "Error: cloudflare.default not set and no CLOUDFLARE_INSTANCE env var" >&2
+        return 1
+      fi
+      load_credentials "cloudflare-${cf_default}"
+      ;;
     *)
       echo "Error: Unknown service '$service'" >&2
-      echo "Supported: portainer, coolify, authentik, glpi, github, gitea-mosaicstack, gitea-usc, woodpecker" >&2
+      echo "Supported: portainer, coolify, authentik, glpi, github, gitea-mosaicstack, gitea-usc, woodpecker, cloudflare, cloudflare-<name>" >&2
       return 1
       ;;
   esac