Create a remotely-managed Cloudflare Tunnel via the API and configure its ingress rules and public hostname routes

Documented steps

1. Create an API token with Account > Cloudflare Tunnel > Edit and Zone > DNS > Edit. Confirm the origin host can reach Cloudflare on outbound port 7844.
2. Create the tunnel: POST https://api.cloudflare.com/client/v4/accounts/{account_id}/cfd_tunnel with `Authorization: Bearer $TOKEN` and body {"name":"api-tunnel","config_src":"cloudflare"}. config_src:"cloudflare" makes it remotely managed (configured via API/dashboard); "local" means a YAML file on the origin machine.
3. Optionally supply "tunnel_secret" — it must be at least 32 bytes and base64-encoded. Omit it and Cloudflare generates one, returned in credentials_file.TunnelSecret.
4. Save result.id (the tunnel_id) and result.token from {"success":true,"result":{"id":...,"name":...,"status":"inactive","remote_config":true,"credentials_file":{...},"token":"eyJ..."}}.
5. Configure ingress: PUT https://api.cloudflare.com/client/v4/accounts/{account_id}/cfd_tunnel/{tunnel_id}/configurations with body {"config":{"ingress":[{"hostname":"app.example.com","service":"http://localhost:8001","originRequest":{}},{"service":"http_status:404"}]}}. Rules match top to bottom.
6. Always terminate the ingress array with a catch-all rule that has no hostname (e.g. {"service":"http_status:404"}) — the docs require it.
7. Create the DNS route: POST https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records with body {"type":"CNAME","proxied":true,"name":"app.example.com","content":"<tunnel_id>.cfargotunnel.com"}.
8. To route a private network instead of a public hostname: POST https://api.cloudflare.com/client/v4/accounts/{account_id}/teamnet/routes with {"network":"172.16.0.0/16","tunnel_id":"<tunnel_id>","comment":"..."}.
9. Run the connector on the origin with the token: `sudo cloudflared service install <TUNNEL_TOKEN>` or `docker run cloudflare/cloudflared:latest tunnel --no-autoupdate run --token <TUNNEL_TOKEN>`. The token can be re-fetched with GET /accounts/{account_id}/cfd_tunnel/{tunnel_id}/token.
10. Verify: GET https://api.cloudflare.com/client/v4/accounts/{account_id}/cfd_tunnel/{tunnel_id}. A healthy remotely-managed tunnel reports status "healthy" with a populated connections array. Docs: https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel-api/ , https://developers.cloudflare.com/api/resources/zero_trust/subresources/tunnels/subresources/cloudflared/methods/create/ , https://developers.cloudflare.com/tunnel/advanced/tunnel-tokens/