infra(tunnel): add zitare.com / zitare.mana.how / zitare-api.mana.how

Three new ingress rules for the Zitare repo (Code/zitare/, separate
repo, deployed under ~/projects/zitare-deploy/ on the Mac Mini).
Ports follow mana/docs/PORTS.md: 3083 api / 3084 app / 3085 com.

zitare.com is a separate Cloudflare zone — the tunnel route for
that hostname needs a one-time `cloudflared tunnel route dns
1435166a-0e3f-4222-8de6-744f32cea5c9 zitare.com` to point the CNAME
at this tunnel. Same for the two .mana.how subdomains, which sit on
the existing mana.how zone.

Code-only: no Mac Mini deploy in this commit. The actual reload
needs ./scripts/mac-mini/sync-tunnel-config.sh after the matching
mana-auth/CORS_ORIGINS + sso-origins changes are committed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cloudflared-config.yml

@@ -184,6 +184,21 @@ ingress:
   - hostname: memoro-audio.mana.how
     service: http://localhost:3101
 
+  # ============================================
+  # Zitare (Code/zitare, separate repo)
+  # ~/projects/zitare-deploy/ on the Mac Mini (planned — Phase 1.6).
+  # Ports per mana/docs/PORTS.md: 3083 api / 3084 app / 3085 com.
+  # zitare.com is a separate Cloudflare zone; tunnel route for that
+  # hostname must be added via `cloudflared tunnel route dns
+  # 1435166a-0e3f-4222-8de6-744f32cea5c9 zitare.com` (one-time).
+  # ============================================
+  - hostname: zitare.com
+    service: http://localhost:3085
+  - hostname: zitare.mana.how
+    service: http://localhost:3084
+  - hostname: zitare-api.mana.how
+    service: http://localhost:3083
+
   # ============================================
   # Standalone web apps (separate containers)
   # ============================================