Cloudflare SSL/TLS mode is on Flexible. That means Cloudflare talks to Vercel over plain HTTP. Vercel redirects HTTP to HTTPS. Cloudflare gets the redirect, passes it to the browser, browser asks Cloudflare over HTTPS again, Cloudflare asks Vercel over HTTP again... loop.
Cloudflare dashboard → SSL/TLS → set mode to Full (strict). Loop gone within a minute.
Even simpler: set the record to DNS only (grey cloud). Vercel already does CDN and certificates, running Cloudflare's proxy in front of it mostly adds a second layer to debug. That also clears the warning on Vercel's domain page.