feat(tunnel): add direction field — support local (-L) port forwards

Previously build_ssh_command only generated -R (reverse) tunnels.
The k3s API tunnel needs -L (local forward: workstation:16443 →
CoulombCore:6443) so kubectl can reach the cluster API directly.

- TunnelConfig.direction: "reverse" (default) | "local"
- config.py: parse direction from YAML, validate allowed values
- manager.py: choose -R or -L flag based on direction

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/bridge/config.py

@@ -87,6 +87,10 @@ def _parse_tunnel(name: str, data: dict) -> TunnelConfig:
             timeout_seconds=hc.get("timeout_seconds", 5),
         )
 
+    direction = str(data.get("direction", "reverse"))
+    if direction not in ("reverse", "local"):
+        raise ConfigError(f"Tunnel '{name}' direction must be 'reverse' or 'local', got: {direction!r}")
+
     return TunnelConfig(
         name=name,
         host=str(data["host"]),
@@ -97,6 +101,7 @@ def _parse_tunnel(name: str, data: dict) -> TunnelConfig:
         actor=str(data["actor"]),
         reconnect=reconnect,
         health_check=health_check,
+        direction=direction,
     )