A practical, low-risk Cloudflare Tunnel pattern for publishing one internal web service without opening router ports.