Harden remote access before enabling it over the public domain

[digtaalfathir]

Remote (SSH/VNC bridge) already has app login + RBAC + audit, but there is no independent front gate. Do not enable it over the public Cloudflare tunnel until this is in place.

Tasks

• Put Cloudflare Access (Zero Trust) in front of the domain (email OTP / SSO) so only authenticated users even reach the login page
• Bind the server to localhost in production (V2_HOST=127.0.0.1 in twinscape/ecosystem.config.js) behind the tunnel/nginx
• Rate-limit the login endpoint (Cloudflare WAF / rule)
• Only after the above: set REMOTE_ENABLE=1 over the public tunnel

Refs: docs/ROADMAP-remote.md (Fase 4), docs/DEPLOY-cloudflare.md