add sandbox.neurontechnologies.ai - internal-only experimentation env

Locked down to email_domain == neurontechnologies.ai via Cloudflare
Access. Dedicated SA with zero prod IAM. Isolated Supabase project
(not a schema in prod). No outbound email path. /api/share and /said
return 410 Gone in sandbox so the public-artifact surface stays
strictly in prod.

Stub deploy ready. Real soul build pipeline lands separately.

servers/gcp/variables.tf

@@ -41,6 +41,12 @@ variable "cloudflare_email" {
   type        = string
 }
 
+variable "cloudflare_account_id" {
+  description = "Cloudflare account ID (used for Zero Trust Access policies)"
+  type        = string
+  sensitive   = true
+}
+
 locals {
   project_id = var.project_id