[Feature] Native Cloudflare Access (Zero Trust) for published domains

What problem will this feature address?

Cloudflare Tunnel (#4309) can publish a domain, but it provides no authentication — anyone with the URL can reach the app. Many self-hosters want to gate internal apps behind Cloudflare Access (Zero Trust) without writing any auth code in the app itself.

Describe the solution you'd like

Build on the Cloudflare Tunnel integration (#4309) to optionally place a published domain behind a Cloudflare Access self-hosted application:

• Per published domain, create a self_hosted Access application bound to the host (configurable session duration).
• Attach a configurable allow policy via POST /accounts/{account_id}/access/apps/{app_id}/policies (include rules: email / email_domain to start).
• A toggle + simple policy editor in the domain dialog; admin-gated; audit-logged.
• Idempotent create/update/delete tied to the domain lifecycle (including parent cascade deletes); seat-limit warning (Zero Trust free plan = 50 users).
• Tests for the application/policy payloads and cleanup.

Describe alternatives you've considered

Manually creating Access applications/policies in the Cloudflare Zero Trust dashboard after publishing via tunnel — it works, but it is manual, error-prone, and not discoverable from Dokploy.

Additional context

Depends on #4309 (Cloudflare Tunnel). Intended as a focused follow-up PR against canary. Happy to align on the policy model / UX before implementing.

Will you send a PR to implement it?

Yes

The payload names no repository files or tests; start by reading the Cloudflare Tunnel integration in issue #4309 and the published-domain dialog and lifecycle entry points. Done means optional per-domain Access application and allow policy support, admin-gated UI, audit logging, idempotent cleanup, seat-limit warning, and payload and cleanup tests.