Function cloudflare_credentials 

pub fn cloudflare_credentials() -> Result<Option<(String, String)>>

Load Cloudflare credentials from vault or environment.

Vault slots → env var fallbacks:

• cloudflare-api-token ↔ CLOUDFLARE_API_TOKEN
• cloudflare-zone-id ↔ CLOUDFLARE_ZONE_ID

Returns Ok(None) when either credential is absent so callers can decide whether to proceed with manual-DNS instructions or bail.