feat(tunnel): add direction field — support local (-L) port forwards

Previously build_ssh_command only generated -R (reverse) tunnels.
The k3s API tunnel needs -L (local forward: workstation:16443 →
CoulombCore:6443) so kubectl can reach the cluster API directly.

- TunnelConfig.direction: "reverse" (default) | "local"
- config.py: parse direction from YAML, validate allowed values
- manager.py: choose -R or -L flag based on direction

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/bridge/manager.py

@@ -18,12 +18,16 @@ log = logging.getLogger(__name__)
 
 
 def build_ssh_command(cfg: TunnelConfig) -> List[str]:
-    """Build the SSH reverse tunnel command."""
+    """Build the SSH tunnel command (reverse -R or local -L)."""
     key = os.path.expanduser(cfg.ssh_key)
+    if cfg.direction == "local":
+        forward_flag = ["-L", f"{cfg.local_port}:127.0.0.1:{cfg.remote_port}"]
+    else:
+        forward_flag = ["-R", f"{cfg.remote_port}:127.0.0.1:{cfg.local_port}"]
     return [
         "ssh",
         "-N",
-        "-R", f"{cfg.remote_port}:127.0.0.1:{cfg.local_port}",
+        *forward_flag,
         "-i", key,
         "-o", "ServerAliveInterval=10",
         "-o", "ServerAliveCountMax=3",