docs: step-by-step hardening for a marketplace install — Cloudflare Tunnel and Tailscale VPN

[vybe]

Summary

A marketplace install answers the public internet at whatever address the provider assigned it. The in-product hardening card offers the two steps that improve that (add a domain, then a Cloudflare Tunnel), but the step-by-step instructions belong in the docs — including a VPN option (Tailscale), which the card does not cover at all. Write that page and link it from the card.

Context

Neither DigitalOcean nor the comparable one-click channels can attach a private network at provision time, so a 1-Click droplet is reachable from the moment it boots. That is acceptable for evaluation, which is what the marketplace listing is for, but the product should say so plainly and give the operator a complete path to a hardened instance.

The in-app card (#2380, #2564) is intentionally minimal — one action on its face, everything explanatory behind a disclosure. The full walkthrough, and the VPN alternative, need a documentation home.

Acceptance Criteria

• A docs page with step-by-step Cloudflare Tunnel setup for a marketplace instance (prerequisites, the exact steps, and how to verify it worked)
• A step-by-step VPN path (Tailscale or equivalent), including any one-click/invite mechanism if one exists
• States the recommended posture plainly: the marketplace default is for evaluation; keep a real instance off the open internet
• Covers the domain step as the first stage, consistent with what the hardening card claims
• Linked from the hardening card and from docs/DEPLOYMENT.md → Security Recommendations
• Reachable from the published docs site, not only the repo

Technical Notes

• Existing security guidance: docs/DEPLOYMENT.md → Security Recommendations
• Card copy that must stay consistent with the page: src/frontend/src/components/onboarding/hardeningGuide.js
• Marketplace image context: packer/digitalocean/README.md