feat: add Kaneo upload DNS

[glitchedmob]

Route uploads.projects.sgf.dev through the cluster tunnel for Kaneo attachment uploads backed by SeaweedFS.

[github-actions]

Terraform plan

Artifacts: https://github.com/sgfdevs/infra-dns/actions/runs/33580241002

Show summary

CHANGE	RESOURCE
add (1)	module.sgf_dev.cloudflare_dns_record.core["projects_uploads"]

Decrypt artifacts:
openssl enc -d -aes-256-cbc -pbkdf2 -in tfplan.enc -out tfplan -pass pass:$OUTPUT_ENCRYPTION_KEY
openssl enc -d -aes-256-cbc -pbkdf2 -in tfplan.txt.enc -out tfplan.txt -pass pass:$OUTPUT_ENCRYPTION_KEY

[glitchedmob]

Superseded by the AWS S3 workload-identity design. Kaneo now uploads directly to the regional AWS S3 endpoint, so no public upload hostname is needed.