[lukepolo]

Fixes from a fresh install on k3s 1.37: the Gateway API CRD race, a silent TimescaleDB step, the Cloudflare token warning, managed Cloudflare behind your own reverse proxy, and the script join's hard-coded 10.42 range.

• Gateway API CRDs: cherry-picks fix: a fresh install on k3s 1.37 waits for the Gateway API CRDs k3s is still creating #736 (343eaee). install_traefik waits for each CRD k3s's gateway-api-crd release is still creating.
• TimescaleDB: the extension step prints "Waiting for TimescaleDB to start (the first start pulls its image)" and is skipped when there was no timescaledb volume before the update. Every kubectl exec in the update path runs under timeout plus --request-timeout, with 120s for queries and 3600s for vacuumdb. That covers the extension queries, both PG_VERSION reads, vacuumdb and the signed clip link check.
• Cloudflare token: setup-env.sh only warns when neither CLOUDFLARE_API_TOKEN nor cloudflare-secrets.env has a token. A Vault install never reaches this check.
• Cloudflare behind a reverse proxy: with REVERSE_PROXY=true, the engine skips the ACME-through-Cloudflare check, the challenge-path rule, the HTTPS redirect rule, the Always Use HTTPS switch and their blocker warnings. It keeps the origin 52x check and Full (strict). setup-env.sh now keeps an explicit REVERSE_PROXY=true alongside CLOUDFLARE_MANAGED.
• Script join ranges: tailscale-api.sh and game-node-server-setup.sh read PANEL_POD_RANGE, PANEL_SERVICE_RANGE and PANEL_TAILSCALE_TAG from .5stack-env.config. These set the routes, grants, tag owner, key tags and the k3s ranges. A cluster whose pods are outside 10.42.0.0/16 and that has no range set is refused instead of getting the shared lines.

[lukepolo]

Local CI on 4c74d2a (Docker on the Mac, one suite container at a time, run against a git archive of this sha):

• Panel scripts (panel-scripts.yml, ubuntu:24.04 + shellcheck/jq/kubectl): the shellcheck step passed, and all 18 test scripts passed. setup_env 28, apply_overlay 3, debug 7, startup_probe 2, system_upgrade 3, plugin 23, node_ip 10, traefik_install 38, write_overlays 21, cloudflare_setup 38, dev_game_server 7, gpu_nodes 8, service 26, postgres_backup 10, choose_node 6, nvidia_fallback 7, image_updates 16, tailscale_api 5. No failures.
• TimescaleDB upgrade (timescaledb-upgrade.yml): the unit shellcheck passed. extension_test 7/7, major_upgrade_test 50/50, docker_test.sh 6/6 against the real pinned images through the Docker socket.
• Gateway (gateway.yml): lint shellcheck passed, and each k3s job ran one at a time. fresh_install 37/37, upgrade (ingress-nginx) 8/8, servicelb_upgrade 6/6, k3s_upgrade 5/5, cert_manager 6/6.
• Cloudflare workers (cloudflare-workers.yml, node:24.22.1): node --test 103/103.
• Fails on the base (10d7716 with only the new tests and stubs): traefik_install 1, extension 4, major_upgrade 3, setup_env 3, cloudflare_setup 3, tailscale_api 4 new tests fail.

The GitHub upgrade-k3s-to-its-own-gateway-api failure on this head is "helm-controller did not apply gateway-crds in time" on k3s 1.36.5. That happens before any code this PR changes runs. The same job passed on the previous head c944227, which had the same scripts (only a .ts test differs), and it passed locally above.