Add internal/delegation: a Cloudflare client and a reconcile pass that lists the zone's NS records, compares them with the instance labels that have live bridged actors, and creates the missing <label>.<BRIDGE_HOSTNAME> NS record pointing at the first configured nameserver. The pass never deletes. A label whose apex NS points elsewhere is reported as conflicting and left alone, and delegations without live actors are reported. Create failures do not stop the pass, and an incomplete or over-long NS listing aborts it before any create. CLOUDFLARE_API_TOKEN and CLOUDFLARE_ZONE_ID enable it; startup is refused when the token is set without the zone ID or without DNS_LISTEN. When enabled, Tidepool runs one pass in the background at startup through the guarded HTTP client. The token is never logged. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>