feat(bootstrap): real olsitec.net config + DNS records (steps 1+2)

CONTRACT_001 amendments: hosts.git, vm.sshPort (default 22; VM uses 222),
cloudflare.zoneId. config.ts + lib/context.ts (provider host uses sshPort).
- components/dns.ts: forge/vault/s3/git.olsitec.net A -> VM (DNS-only, own CF
  provider from encrypted token). Deployed + verified authoritative = 204.168.234.72.
- Pulumi.foundation.yaml: real config (olsitec.net, vm 204.168.234.72:222,
  letsencrypt-dns01) + encrypted secrets (cloudflare token, offsite creds).
  Master passphrase: pass olsitec-foundation/PULUMI_CONFIG_PASSPHRASE.
- run.sh: reproducible deploy (passphrase + ssh key from pass/home).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

bootstrap/package.json

@@ -8,7 +8,8 @@
         "@olsitec/pulumi-docker": "workspace:*",
         "@olsitec/pulumi-vault": "workspace:*",
         "@pulumi/docker": "^4.5.8",
-        "@pulumi/pulumi": "^3.138.0"
+        "@pulumi/pulumi": "^3.138.0",
+        "@pulumi/cloudflare": "^5.45.0"
     },
     "devDependencies": {
         "@types/node": "^18",