cloudflare: disable managed robots.txt; fix v5 config bugs

- Add cloudflare_bot_management for all zones with is_robots_txt_managed=false
  so each app's own robots.txt is served instead of Cloudflare's managed one
- Fix zone_setting id zero_rtt -> 0rtt (invalid id rejected by API)
- Fix security_header value: object instead of jsonencode (avoids perpetual diff)
- Fix firewall expression http.request.user_agent -> http.user_agent (invalid field)
- tofu fmt reindentation

tofu/cloudflare.tf

@@ -383,7 +383,7 @@ resource "cloudflare_zone_setting" "aprs_me_tls_1_3" {
 
 resource "cloudflare_zone_setting" "aprs_me_zero_rtt" {
   zone_id    = cloudflare_zone.zones["aprs.me"].id
-  setting_id = "zero_rtt"
+  setting_id = "0rtt"
   value      = "on"
 }
 
@@ -396,7 +396,7 @@ resource "cloudflare_zone_setting" "aprs_me_ssl" {
 resource "cloudflare_zone_setting" "aprs_me_security_header" {
   zone_id    = cloudflare_zone.zones["aprs.me"].id
   setting_id = "security_header"
-  value = jsonencode({
+  value = {
     strict_transport_security = {
       enabled            = true
       max_age            = 15552000
@@ -404,7 +404,7 @@ resource "cloudflare_zone_setting" "aprs_me_security_header" {
       preload            = true
       nosniff            = true
     }
-  })
+  }
 }
 
 # towerops.net
@@ -428,7 +428,7 @@ resource "cloudflare_zone_setting" "towerops_net_tls_1_3" {
 
 resource "cloudflare_zone_setting" "towerops_net_zero_rtt" {
   zone_id    = cloudflare_zone.zones["towerops.net"].id
-  setting_id = "zero_rtt"
+  setting_id = "0rtt"
   value      = "on"
 }
 
@@ -441,7 +441,7 @@ resource "cloudflare_zone_setting" "towerops_net_ssl" {
 resource "cloudflare_zone_setting" "towerops_net_security_header" {
   zone_id    = cloudflare_zone.zones["towerops.net"].id
   setting_id = "security_header"
-  value = jsonencode({
+  value = {
     strict_transport_security = {
       enabled            = true
       max_age            = 15552000
@@ -449,7 +449,7 @@ resource "cloudflare_zone_setting" "towerops_net_security_header" {
       preload            = true
       nosniff            = true
     }
-  })
+  }
 }
 
 # gridmap.org
@@ -473,7 +473,7 @@ resource "cloudflare_zone_setting" "gridmap_org_tls_1_3" {
 
 resource "cloudflare_zone_setting" "gridmap_org_zero_rtt" {
   zone_id    = cloudflare_zone.zones["gridmap.org"].id
-  setting_id = "zero_rtt"
+  setting_id = "0rtt"
   value      = "on"
 }
 
@@ -486,7 +486,7 @@ resource "cloudflare_zone_setting" "gridmap_org_ssl" {
 resource "cloudflare_zone_setting" "gridmap_org_security_header" {
   zone_id    = cloudflare_zone.zones["gridmap.org"].id
   setting_id = "security_header"
-  value = jsonencode({
+  value = {
     strict_transport_security = {
       enabled            = true
       max_age            = 15552000
@@ -494,8 +494,34 @@ resource "cloudflare_zone_setting" "gridmap_org_security_header" {
       preload            = true
       nosniff            = true
     }
-  })
+  }
 }
+
+# =============================================================================
+# Bot Management - disable Cloudflare managed robots.txt
+#
+# Each app repo ships its own robots.txt. Turning off the managed robots.txt
+# feature ("Instruct AI bot traffic with robots.txt") stops Cloudflare from
+# prepending/serving its own robots.txt at the zone edge, so the origin's file
+# is returned unchanged. All other bot_management fields are Optional+Computed,
+# so omitting them preserves their current values (e.g. Super Bot Fight Mode).
+#
+# NOTE: requires CLOUDFLARE_API_TOKEN to include the "Bot Management Write"
+# permission for these zones; the DNS-scoped token cannot apply this.
+# =============================================================================
+
+resource "cloudflare_bot_management" "zones" {
+  for_each = cloudflare_zone.zones
+
+  zone_id               = each.value.id
+  is_robots_txt_managed = false
+}
+
+resource "cloudflare_bot_management" "w5isp_com" {
+  zone_id               = cloudflare_zone.w5isp_com.id
+  is_robots_txt_managed = false
+}
+
 # =============================================================================
 # Firewall - custom rules (applied to all zones)
 # =============================================================================
@@ -514,7 +540,7 @@ locals {
     "(http.request.uri.path contains \"/.git\")",
     "(http.request.uri.path contains \"/phpmyadmin\")",
     "(http.request.uri.path contains \"/cgi-bin\")",
-    "(not http.request.user_agent exists)",
+    "(not http.user_agent ne \"\")",
   ])
 }
 
@@ -1048,7 +1074,7 @@ resource "cloudflare_zone_setting" "w5isp_com_tls_1_3" {
 
 resource "cloudflare_zone_setting" "w5isp_com_zero_rtt" {
   zone_id    = cloudflare_zone.w5isp_com.id
-  setting_id = "zero_rtt"
+  setting_id = "0rtt"
   value      = "on"
 }
 
@@ -1061,7 +1087,7 @@ resource "cloudflare_zone_setting" "w5isp_com_ssl" {
 resource "cloudflare_zone_setting" "w5isp_com_security_header" {
   zone_id    = cloudflare_zone.w5isp_com.id
   setting_id = "security_header"
-  value = jsonencode({
+  value = {
     strict_transport_security = {
       enabled            = true
       max_age            = 15552000
@@ -1069,7 +1095,7 @@ resource "cloudflare_zone_setting" "w5isp_com_security_header" {
       preload            = true
       nosniff            = true
     }
-  })
+  }
 }
 
 # =============================================================================