Adding CF API key to the customer account is not very hard. I'm okay with that being separate as some clients have their own cloudflare accounts too. I vote against changing that.
The CloudFlare DNS record wiping, i think this would easily be solved by simply making a decent map of how cloudflare exports their records. Simply hit export cloudflare dns records, and import into enhance (when we have this feature it will solve the whole problem). (ChatGPT could write this lol)
I for the life of me do not understand why having a CAA record (prior to syncing) breaks enhance if enhance deletes all the records anyway. It's such an annoying setup lol.