docs: step-by-step Cloudflare API token setup for LAN HTTPS, with token check and 6003 error fix

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -814,24 +814,46 @@ sudo apt install -y certbot python3-certbot-dns-cloudflare
 
 ### Step 4 — Create a scoped Cloudflare API token
 
-Cloudflare dashboard → profile icon → **My Profile** → **API Tokens** → **Create Token** → use the
+**4a. Create the token (in a browser):**
-**"Edit zone DNS"** template, restricted to **Specific zone → mydentalofficemanagement.com**.
 
-Save it in a credentials file, root-only:
+1. Go to `dash.cloudflare.com` → profile icon (top right) → **My Profile** → **API Tokens** → **Create Token**
+2. Use the **Edit zone DNS** template
+3. Under **Zone Resources**, choose **Specific zone** → `mydentalofficemanagement.com`
+4. Click **Continue to summary** → **Create Token**, then copy the token. It's only shown once.
+
+**4b. Check the token works** (replace `YOUR_TOKEN`):
+
+```sh
+curl -s -H "Authorization: Bearer YOUR_TOKEN" https://api.cloudflare.com/client/v4/user/tokens/verify
+# should include: "status":"active"
+```
+
+**4c. Save it in a root-only credentials file:**
 
 ```sh
 sudo mkdir -p /etc/letsencrypt
 sudo nano /etc/letsencrypt/cloudflare.ini
 ```
 
+Make the file exactly this one line, with your token pasted after `= ` (paste in the terminal with `Ctrl+Shift+V`; clear old lines with `Ctrl+K`):
+
 ```ini
 dns_cloudflare_api_token = <paste token here>
 ```
 
+No quote marks, and no spaces or line breaks after the token. Save and exit with `Ctrl+O`, `Enter`, `Ctrl+X`, then lock the file:
+
 ```sh
 sudo chmod 600 /etc/letsencrypt/cloudflare.ini
 ```
 
+> **If certbot fails with `Error determining zone_id: 6003 Invalid request headers`,** the token in
+> this file is malformed: the `<paste token here>` placeholder was left in, there are extra
+> characters or quotes, or the token ID / Global API Key was copied instead of the token itself.
+> Check it with `sudo cat /etc/letsencrypt/cloudflare.ini`, re-test with 4b, fix the file, and run
+> Step 5 again. (The yellow `PendingDeprecationWarning` box certbot prints about the `cloudflare`
+> Python package is harmless.)
+
 > The same token can be reused across offices (Cloudflare tokens are scoped to the whole zone,
 > not a single subdomain) — but issuing one token per server makes it easy to revoke just one if
 > a machine is ever decommissioned.