fix: correct Cloudflare DNS A record IP to use public IP not Tailscale

Changed from Tailscale internal IP (100.95.3.92) to public IP (216.158.230.94)

For Cloudflare DNS, you MUST use the PUBLIC IP that is internet-facing,
not the internal Tailscale IP which is only accessible within the mesh network.

Cloudflare A Record should point to:
- IPv4: 216.158.230.94 (nexus-vector PUBLIC IP)
- NOT: 100.95.3.92 (Tailscale internal IP - won't work\!)

Updated all references in CLOUDFLARE_DNS_SETUP.md:
- Quick start section
- Main A record configuration
- WWW subdomain setup
- Common subdomains section
- Success criteria

Correct configuration:
Type | Name | IPv4 | Proxy
-----|------|------|-------
A | mtd.runfoo.run | 216.158.230.94 | Proxied
A | www | 216.158.230.94 | Proxied

CLOUDFLARE_DNS_SETUP.md

@@ -1,7 +1,7 @@
 # Cloudflare DNS Configuration Guide
 
 **Domain**: mtd.runfoo.run
-**Target**: nexus-vector (100.95.3.92)
+**Target**: nexus-vector (216.158.230.94 - PUBLIC IP)
 **Job ID**: MTAD-IMPL-2025-11-18-CL
 **Date**: 2025-11-18
 
@@ -12,7 +12,7 @@
 ### What You Need
 - Cloudflare account (free tier works great)
 - Domain: mtd.runfoo.run
-- Target IP: 100.95.3.92 (nexus-vector)
+- Target IP: **216.158.230.94** (nexus-vector PUBLIC IP - NOT Tailscale!)
 
 ### 5-Step Setup
 
@@ -95,7 +95,7 @@ In Cloudflare dashboard, click **"DNS"** in the left menu.
 2. Set:
    - **Type**: A
    - **Name**: mtd.runfoo.run (or just `@`)
-   - **IPv4 address**: 100.95.3.92
+   - **IPv4 address**: **216.158.230.94** (PUBLIC IP)
    - **TTL**: Auto (or 3600)
    - **Proxy status**: **Proxied** (orange cloud) ⭐ IMPORTANT
 3. Click **"Save"**
@@ -106,7 +106,7 @@ In Cloudflare dashboard, click **"DNS"** in the left menu.
 2. Set:
    - **Type**: A
    - **Name**: www
-   - **IPv4 address**: 100.95.3.92
+   - **IPv4 address**: **216.158.230.94** (PUBLIC IP)
    - **TTL**: Auto
    - **Proxy status**: **Proxied**
 3. Click **"Save"**
@@ -114,10 +114,10 @@ In Cloudflare dashboard, click **"DNS"** in the left menu.
 Your DNS records should now look like:
 
 ```
-Type | Name              | Content     | TTL  | Status
+Type | Name              | Content         | TTL  | Status
------|-------------------|-------------|------|--------
+-----|-------------------|-----------------|----- |--------
-A    | mtd.runfoo.run    | 100.95.3.92 | Auto | Proxied
+A    | mtd.runfoo.run    | 216.158.230.94  | Auto | Proxied
-A    | www               | 100.95.3.92 | Auto | Proxied
+A    | www               | 216.158.230.94  | Auto | Proxied
 ```
 
 ### Step 6: Configure SSL/TLS
@@ -222,7 +222,7 @@ nslookup -type=NS mtd.runfoo.run
 nslookup mtd.runfoo.run
 
 # Should show:
-# Address: 100.95.3.92
+# Address: 216.158.230.94
 ```
 
 ### 3. HTTPS Accessibility
@@ -360,7 +360,7 @@ If you want subdomains like `api.mtd.runfoo.run`:
 2. Set:
    - **Type**: A
    - **Name**: api
-   - **IPv4 address**: 100.95.3.92
+   - **IPv4 address**: **216.158.230.94** (PUBLIC IP)
    - **Proxy status**: Proxied
 3. Click **"Save"**
 
@@ -369,10 +369,10 @@ Now `api.mtd.runfoo.run` will work!
 ### Common Subdomains to Add
 
 ```
-api.mtd.runfoo.run         → 100.95.3.92 (API endpoints)
+api.mtd.runfoo.run         → 216.158.230.94 (API endpoints)
-admin.mtd.runfoo.run       → 100.95.3.92 (Admin panel)
+admin.mtd.runfoo.run       → 216.158.230.94 (Admin panel)
-docs.mtd.runfoo.run        → 100.95.3.92 (API docs)
+docs.mtd.runfoo.run        → 216.158.230.94 (API docs)
-status.mtd.runfoo.run      → 100.95.3.92 (Status page)
+status.mtd.runfoo.run      → 216.158.230.94 (Status page)
 ```
 
 ---
@@ -572,7 +572,7 @@ Once Cloudflare DNS is configured:
 
 You'll know DNS is properly configured when:
 
-✅ `nslookup mtd.runfoo.run` shows `100.95.3.92`
+✅ `nslookup mtd.runfoo.run` shows `216.158.230.94`
 ✅ `curl https://mtd.runfoo.run/health` returns 200 OK
 ✅ `curl https://mtd.runfoo.run/api/v1/health` returns API response
 ✅ Browser shows padlock icon (HTTPS)
@@ -592,6 +592,6 @@ You'll know DNS is properly configured when:
 **Job ID**: MTAD-IMPL-2025-11-18-CL
 **Last Updated**: 2025-11-18
 **Domain**: mtd.runfoo.run
-**Target**: nexus-vector (100.95.3.92)
+**Target**: nexus-vector (216.158.230.94 - PUBLIC IP)
 
 **Ready to configure Cloudflare? Start with Step 1! 🚀**