feat(tunnel): add direction field — support local (-L) port forwards

Previously build_ssh_command only generated -R (reverse) tunnels.
The k3s API tunnel needs -L (local forward: workstation:16443 →
CoulombCore:6443) so kubectl can reach the cluster API directly.

- TunnelConfig.direction: "reverse" (default) | "local"
- config.py: parse direction from YAML, validate allowed values
- manager.py: choose -R or -L flag based on direction

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/bridge/models.py

@@ -40,6 +40,7 @@ class TunnelConfig:
     actor: str
     reconnect: ReconnectPolicy = field(default_factory=ReconnectPolicy)
     health_check: Optional[HealthCheckConfig] = None
+    direction: str = "reverse"  # "reverse" (-R) or "local" (-L)
 
 
 @dataclass