fix: run tunnel containers on backend network with container name DNS

The host-network tunnel approach had issues because localhost inside
the tunnel container wasn't reaching the host-published ports correctly.

This reverts to running cloudflared as a Docker container on the
'backend' network, where Docker DNS resolves container names reliably.
The tunnel connects to http://{container_name}:{container_port}.

- apps/api/src/services/tunnel.py: use --network backend instead of host
- apps/api/src/api/tool_instances.py: pass container_port (default_port)
  instead of published_port (host port) to tunnel functions

Quality gates: ruff clean

apps/api/src/api/tool_instances.py

@@ -1962,12 +1962,11 @@ async def start_instance(
             "error": f"Tool type '{instance.tool_type_id}' not found",
         }
 
-    published_port = instance.port or 0
     logger.debug(
-        "Tool type for instance %s: name=%s, published_port=%s, interface_type=%s",
+        "Tool type for instance %s: name=%s, container_port=%s, interface_type=%s",
         instance.id,
         tool_type.name,
-        published_port,
+        tool_type.default_port or 0,
         tool_type.interface_type,
     )
 
@@ -1976,13 +1975,13 @@ async def start_instance(
         # Create temporary Cloudflare tunnel for public access
         try:
             logger.debug(
-                "Creating tunnel for instance %s (port=%d)",
+                "Creating tunnel for instance %s (container_port=%d)",
                 instance.id,
-                published_port,
+                tool_type.default_port or 0,
             )
             tunnel_info = start_tunnel(
                 instance_name=instance.name,
-                published_port=published_port,
+                container_port=tool_type.default_port or 0,
             )
             instance.tunnel_id = tunnel_info["container_name"]
             instance.public_url = tunnel_info["url"]
@@ -2204,7 +2203,7 @@ async def restart_instance(
                 try:
                     tunnel_info = start_tunnel(
                         instance_name=instance.name,
-                        published_port=instance.port or 0,
+                        container_port=tool_type.default_port or 0,
                     )
                     instance.tunnel_id = tunnel_info["container_name"]
                     instance.public_url = tunnel_info["url"]
@@ -2437,10 +2436,17 @@ async def recreate_tunnel_endpoint(
                 "message": "Tunnel is already healthy",
             }
 
+    tool_type = await session.get(ToolType, instance.tool_type_id)
+    if not tool_type:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Tool type not found for this instance",
+        )
+
     try:
         tunnel_info = recreate_tunnel(
             instance_name=instance.name,
-            published_port=instance.port or 0,
+            container_port=tool_type.default_port or 0,
         )
         instance.tunnel_id = tunnel_info["container_name"]
         instance.public_url = tunnel_info["url"]