Add Cloudflare provider and neural-platform tunnel config to Terraform

Tunnel routes were being managed ad-hoc via Cloudflare API. Now codified
in Terraform so they can't drift — neuron.neuralplatform.ai was missing
from the tunnel config, causing 404s for Neuron MCP connections.

Also fix mcp.json: type http → sse (Neuron uses SSE transport, not
streamable HTTP). CF-Access headers were already present and correct.

servers/legion/variables.tf

@@ -39,3 +39,15 @@ variable "gitea_api_token" {
   type        = string
   sensitive   = true
 }
+
+variable "cloudflare_tunnel_id" {
+  description = "Cloudflare tunnel ID (main legion tunnel)"
+  type        = string
+  sensitive   = true
+}
+
+variable "cloudflare_account_id" {
+  description = "Cloudflare account ID"
+  type        = string
+  sensitive   = true
+}