feat: add path-scoped Access app for Grafana alerts API

[xnoto]

What

cf-access-grafana.tf adds a path-scoped Cloudflare Access application (grafana.makeitwork.cloud/api/alertmanager/grafana) requiring the existing GitHub Actions service token (the same token_id referenced by the warp app in cf-warp.tf — no new token to manage).

This is the machine-auth layer for the Dependabot PR alerting pipeline: GitHub Actions POSTs synthetic alerts to Grafana's embedded Alertmanager API; the rest of grafana.makeitwork.cloud is unaffected and stays behind Dex OIDC only. Grafana still enforces its own auth (service account token) on the API — defense in depth.

Also

• .gitleaks.toml: extends the existing cf-warp.tf allowlist (service token IDs are public identifiers, not credentials) to the new file. Same regex, same justification.
• README.md regenerated by terraform-docs (new resource row).

Merge order

Third (independent of the others; any order works, but alerting POSTs 401/403 until this and the Grafana token are in place).

Validation

• make test — all hooks pass (validate, tflint, checkov, fmt, docs, gitleaks).
• No tofu plan/apply locally — live backend; credentialed plan runs in CI on this PR.

[github-actions]

OpenTofu Plan

OpenTofu will perform the following actions:

  # cloudflare_zero_trust_access_application.grafana_alerts will be created
  + resource "cloudflare_zero_trust_access_application" "grafana_alerts" {
      + account_id                 = (sensitive value)
      + app_launcher_visible       = true
      + aud                        = (known after apply)
      + destinations               = (known after apply)
      + domain                     = "grafana.makeitwork.cloud/api/alertmanager/grafana"
      + http_only_cookie_attribute = true
      + id                         = (known after apply)
      + name                       = "Grafana Alerts API"
      + policies                   = [
          + {
              + decision   = "non_identity"
              + include    = [
                  + {
                      + service_token = {
                          + token_id = "635d3164-6e89-4b4b-9812-112b77fdd797"
                        }
                    },
                ]
              + name       = "GitHub Actions"
              + precedence = 1
            },
        ]
      + self_hosted_domains        = (known after apply)
      + session_duration           = "24h"
      + type                       = "self_hosted"
    }

Plan: 1 to add, 0 to change, 0 to destroy.