fix: drop render customDomains, use Cloudflare proxy for backend

Render's free plan rejects customDomains in render.yaml at apply time
(reported error: 'Custom domains require a paid plan'). Switch to
Cloudflare proxy + Universal SSL to keep a custom domain for free.

- render.yaml: remove customDomains block, update BACKEND_URL comment
- variables.tf: backend_subdomain default 'api' -> 'senzen-api'
  (one level deep under pantorn.site, covered by Cloudflare
  Universal SSL; two levels would need a paid Advanced cert)
- cloudflare.tf: backend record proxied = true (was false)
  with comment explaining the Cloudflare 'Full' SSL mode
  workaround; frontend stays DNS-only (Vercel issues its own
  cert via ACME HTTP-01 which breaks behind orange cloud)

New public URLs:
  Frontend:  https://senzen.pantorn.site        (Vercel)
  Backend:   https://senzen-api.pantorn.site    (Cloudflare → Render)

Author: Long104

infra/terraform/cloudflare.tf

@@ -3,34 +3,47 @@
 # =============================================================
 # This file manages the DNS records for the Senzen project.
 # Records:
-#   senzen        CNAME → cname.vercel-dns.com      (frontend)
-#   api.senzen    CNAME → <render-service>.onrender.com (backend)
+#   senzen         CNAME → cname.vercel-dns.com          (frontend,  DNS-only)
+#   senzen-api     CNAME → <render-service>.onrender.com (backend,   Cloudflare-proxied)
 #
-# Both are DNS-only (proxied = false) so Vercel/Render can
-# issue and serve their own TLS certificates. The orange-cloud
-# proxy would break ACME HTTP-01 challenges for cert issuance.
+# The backend is proxied (orange cloud) because Render's free
+# plan does NOT support custom domains — so the service runs
+# at senzen-api.onrender.com, and Cloudflare terminates TLS
+# for senzen-api.pantorn.site using Universal SSL, then
+# forwards to Render in "Full" SSL mode (no cert verification).
+#
+# Both records are ONE level deep under pantorn.site so they're
+# covered by Cloudflare's Universal SSL (*.pantorn.site).
 # =============================================================
 
 # ─────────────────────────────────────────────────────────────
-# Frontend: senzen.pantorn.site → Vercel
+# Frontend: senzen.pantorn.site → Vercel (DNS-only)
+# Vercel issues its own Let's Encrypt cert via ACME HTTP-01,
+# which fails if Cloudflare proxy is on. So we leave it
+# proxied = false and let Vercel handle TLS.
 # ─────────────────────────────────────────────────────────────
 resource "cloudflare_record" "senzen_frontend" {
   zone_id = var.cloudflare_zone_id
   name    = split(".", var.frontend_domain)[0] # "senzen" from "senzen.pantorn.site"
   type    = "CNAME"
   value   = var.vercel_cname_target
   proxied = false
-  comment = "Senzen frontend → Vercel"
+  comment = "Senzen frontend → Vercel (DNS-only, Vercel issues cert)"
 }
 
 # ─────────────────────────────────────────────────────────────
-# Backend: api.senzen.pantorn.site → Render
+# Backend: senzen-api.pantorn.site → Render (proxied)
+# Render free plan doesn't issue certs for custom domains.
+# Cloudflare proxies, terminates TLS with Universal SSL, and
+# forwards to Render's onrender.com URL. Set Cloudflare zone
+# SSL mode to "Full" (NOT "Full (Strict)") so the origin cert
+# isn't required to be valid for senzen-api.pantorn.site.
 # ─────────────────────────────────────────────────────────────
 resource "cloudflare_record" "senzen_backend" {
   zone_id = var.cloudflare_zone_id
-  name    = "${var.backend_subdomain}.${split(".", var.frontend_domain)[0]}" # "api.senzen"
+  name    = var.backend_subdomain # "senzen-api"
   type    = "CNAME"
   value   = "${var.render_service_name}.onrender.com"
-  proxied = false
-  comment = "Senzen backend → Render (${var.render_service_name}.onrender.com)"
+  proxied = true
+  comment = "Senzen backend → Render via Cloudflare proxy (Render free doesn't support custom domains)"
 }

infra/terraform/variables.tf

@@ -63,9 +63,9 @@ variable "frontend_domain" {
 }
 
 variable "backend_subdomain" {
-  description = "Subdomain label for the backend (relative to frontend_domain). Final URL: <backend_subdomain>.<frontend_domain>"
+  description = "Subdomain label for the backend (one level deep under cloudflare_zone_name). Must be ONE level deep to be covered by Cloudflare Universal SSL. Final URL: <backend_subdomain>.<cloudflare_zone_name>"
   type        = string
-  default     = "api"
+  default     = "senzen-api"
 }
 
 # ─────────────────────────────────────────────────────────────

render.yaml

@@ -8,6 +8,12 @@
 # Free plan = 512 MB RAM, 0.1 vCPU, sleeps after 15 min idle.
 # Auto-deploys on every push to main.
 #
+# NOTE on custom domains: render.yaml does NOT support custom
+# domains on the free plan. The service runs at
+#   https://senzen-api.onrender.com
+# and Cloudflare proxies the public URL (senzen-api.pantorn.site)
+# to it via "Full" SSL mode. See infra/terraform/cloudflare.tf.
+#
 # Sensitive env vars are marked `sync: false` — you set the
 # values once in the Render dashboard, and they stay out of git.
 # =============================================================
@@ -40,7 +46,7 @@ services:
       - key: FRONTEND_URL
         value: https://senzen.pantorn.site
       - key: BACKEND_URL
-        value: https://api.senzen.pantorn.site
+        value: https://senzen-api.pantorn.site
       - key: GO_ENV
         value: production
 
@@ -61,6 +67,3 @@ services:
         sync: false
       - key: GITHUB_CLIENT_SECRET
         sync: false
-
-    customDomains:
-      - name: api.senzen.pantorn.site