fix(cloudflared): code-server binds to 127.0.0.1 causing tunnel app error 0

Root cause: code-server (and similar web tools) default to binding to
127.0.0.1 (localhost) inside their containers. This makes them unreachable
from the Docker network and from cloudflared, which connects via the
container's Docker network name.

Changes:
- Migration: Update code-server compose_template to include
  --bind-addr 0.0.0.0:8443 command override
- Migration: Update jupyter-notebook compose_template to include
  --ip=0.0.0.0 flag
- Runtime safety net: _ensure_web_bind_address() auto-injects bind
  address for known web tools (code-server, jupyter-notebook) when
  compose doesn't already specify a command
- Diagnostics: _check_app_binding() compares internal vs external
  connectivity to detect 127.0.0.1 binding issues
- Improved readiness check: 30s timeout, checks HTTP status codes,
  logs curl stderr for debugging

Files:
- apps/api/alembic/versions/2026_05_29_fix_web_tool_bind_address.py
- apps/api/src/services/docker.py
- apps/api/src/api/tool_instances.py
- apps/api/tests/integration/test_tool_types_api_extended.py

Quality gates: pytest 42 passed (5 pre-existing unrelated failures)

apps/api/src/services/docker.py

@@ -384,9 +384,7 @@ def find_free_port(start: int = 10000, end: int = 20000) -> int:
     raise RuntimeError(f"No free port found in range {start}-{end}")
 
 
-def _check_app_binding(
-    container_name: str, port: int
-) -> dict[str, str | bool]:
+def _check_app_binding(container_name: str, port: int) -> dict[str, str | bool]:
     """Diagnose whether the app is bound to 127.0.0.1 or 0.0.0.0.
 
     Checks from both inside the container (localhost) and outside