fix(infra): disable Kura Cloudflare load balancing

Resolves https://github.com/tuist/tuist/actions/runs/26625595391/job/78466263474

Fixes the Kura cache endpoint failure mode where Cloudflare load-balancer origin quota exhaustion could leave the server returning an empty cache endpoint in a successful API response.

• Disable Kura Cloudflare load balancing entirely in the managed production and regional Kura Helm overlays so the controller is no longer wired with Cloudflare LB credentials or flags.
• Return 503 from the cache endpoints API when Kura endpoint resolution yields an empty endpoint instead of handing clients an invalid URL.
• Preserve structured Cloudflare API errors in the Kura controller and classify 400 origin-limit responses explicitly.
• Treat Cloudflare origin-limit failures as degraded global endpoint reconciliation so workload status can still converge without the controller entering the hard-error retry path if Cloudflare LB is re-enabled later.

How to test locally

• mise exec go -- go test ./... from infra/kura-controller
• mix test test/tuist_web/controllers/api/cache_controller_test.exs from server
• helm template tuist infra/helm/tuist -f infra/helm/tuist/values-managed-common.yaml -f infra/helm/tuist/values-managed-production.yaml --set server.image.tag=test --set kuraController.image.tag=test --set clickhouse.external.url=http://clickhouse.example.com | rg -n "cloudflare-api-token|CLOUDFLARE_API_TOKEN|cloudflare-zone|cloudflare-api-token|reconcile-global-endpoints|require-global-endpoints"
• helm template tuist infra/helm/tuist -f infra/helm/tuist/values-managed-kura-region.yaml --set kuraController.image.tag=test | rg -n "cloudflare-api-token|CLOUDFLARE_API_TOKEN|cloudflare-zone|cloudflare-api-token|reconcile-global-endpoints|require-global-endpoints"
• git diff --check