Close RAIL-HO-WP-0009 declared-state gaps; leave live 6443 prune gated

Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN
open to Anywhere, tag the base role so firewall can be scoped, and
schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage
false so a converge cannot enable UFW there. T02 still needs operator
approval for make converge-firewall HOST=Railiance01.

docs/k3s-api-access.md

@@ -0,0 +1,48 @@
+# k3s API access
+
+The Kubernetes API is not on the public internet. See
+[ADR-005](adr/ADR-005-k3s-api-tunnel-only.md).
+
+## Day-to-day (workstation)
+
+```bash
+bridge up k3s-api-railiance01     # https://127.0.0.1:16444  →  Railiance01 :6443
+bridge up k3s-api-coulombcore     # https://127.0.0.1:16443  →  CoulombCore :6443
+bridge status
+```
+
+Point the kubeconfig `server` at the matching local port. The default
+`~/.kube/config` and `~/.kube/config-hosteurope` currently both target
+`https://127.0.0.1:16443` (CoulombCore). For Railiance01 use 16444.
+
+```bash
+# Railiance01
+KUBECONFIG=~/.kube/config-railiance01 kubectl get nodes
+# or, once:
+#   kubectl --kubeconfig ~/.kube/config-railiance01 config set-cluster default --server=https://127.0.0.1:16444
+```
+
+SSH is unaffected. If the tunnel is down, recover over SSH:
+
+```bash
+ssh tegwick@92.205.62.239 -- sudo k3s kubectl get nodes
+```
+
+## What not to do
+
+- Do not `ufw allow 6443/tcp` from the current public IP.
+- Do not add addresses to `k3s_api_allowed_sources` without amending ADR-005.
+- When an old grant must die, put it in `k3s_api_revoked_sources` and run
+  `make converge-firewall HOST=Railiance01`.
+
+## Converge the firewall only
+
+The base role is tagged. Firewall changes no longer drag sshd restarts or
+user-slice memory caps with them:
+
+```bash
+make converge-firewall HOST=Railiance01
+```
+
+CoulombCore sets `ufw_manage: false`. That host's live filter is iptables, not
+UFW; this target will skip UFW tasks there.