feat: add Cloudflare DNS tool suite with multi-instance support

- zone-list, record-list, record-create, record-update, record-delete
- Named instance support (-a flag) with configurable default
- Zone name-to-ID auto-resolution in shared _lib.sh
- Updated credentials loader with cloudflare/cloudflare-<name> services
- TOOLS.md and INFRASTRUCTURE.md guide documentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tools/cloudflare/_lib.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+#
+# _lib.sh — Shared helpers for Cloudflare tool scripts
+#
+# Usage: source "$(dirname "$0")/_lib.sh"
+#
+# Provides:
+#   CF_API                          — Base API URL
+#   cf_auth                         — Authorization header value
+#   cf_load_instance <instance>     — Load credentials for a specific or default instance
+#   cf_resolve_zone <name_or_id>    — Resolves a zone name to its ID (passes IDs through)
+
+CF_API="https://api.cloudflare.com/client/v4"
+
+cf_auth() {
+  echo "Bearer $CLOUDFLARE_API_TOKEN"
+}
+
+# Load credentials for a Cloudflare instance.
+# If instance is empty, loads the default.
+cf_load_instance() {
+  local instance="$1"
+  if [[ -n "$instance" ]]; then
+    load_credentials "cloudflare-${instance}"
+  else
+    load_credentials cloudflare
+  fi
+}
+
+# Resolve a zone name (e.g. "mosaicstack.dev") to its zone ID.
+# If the input is already a 32-char hex ID, passes it through.
+cf_resolve_zone() {
+  local input="$1"
+
+  # If it looks like a zone ID (32 hex chars), pass through
+  if [[ "$input" =~ ^[0-9a-f]{32}$ ]]; then
+    echo "$input"
+    return 0
+  fi
+
+  # Resolve by name
+  local response
+  response=$(curl -s -w "\n%{http_code}" \
+    -H "Authorization: $(cf_auth)" \
+    -H "Content-Type: application/json" \
+    "${CF_API}/zones?name=${input}&status=active")
+
+  local http_code
+  http_code=$(echo "$response" | tail -n1)
+  local body
+  body=$(echo "$response" | sed '$d')
+
+  if [[ "$http_code" != "200" ]]; then
+    echo "Error: Failed to resolve zone '$input' (HTTP $http_code)" >&2
+    return 1
+  fi
+
+  local zone_id
+  zone_id=$(echo "$body" | jq -r '.result[0].id // empty')
+
+  if [[ -z "$zone_id" ]]; then
+    echo "Error: Zone '$input' not found" >&2
+    return 1
+  fi
+
+  echo "$zone_id"
+}