feat: route sgf.dev through public edge

[glitchedmob]

Routes the sgf.dev apex through the shared x86 public edge while preserving the existing www.sgf.dev CNAME to the apex.

• Add a proxied media.sgf.dev CNAME to www.sgf.dev.
• Rely on the application cache headers and Cloudflare default static-file caching, as verified in staging.
• Remove the unapplied cache ruleset that required unavailable Cloudflare permissions.

[github-actions]

Terraform plan

Artifacts: https://github.com/sgfdevs/infra-dns/actions/runs/31294848945

Show summary

CHANGE	RESOURCE
add (1)	module.sgf_dev.cloudflare_dns_record.core["media"]
update (1)	module.sgf_dev.cloudflare_dns_record.core["apex"]

Decrypt artifacts:
openssl enc -d -aes-256-cbc -pbkdf2 -in tfplan.enc -out tfplan -pass pass:$OUTPUT_ENCRYPTION_KEY
openssl enc -d -aes-256-cbc -pbkdf2 -in tfplan.txt.enc -out tfplan.txt -pass pass:$OUTPUT_ENCRYPTION_KEY