fix: port useful fixes from overwritten main merge

From ae02e97 ('fix: tunnel URLs, session naming, git control bar placement'):

1. Tunnel URL regex: exclude api.trycloudflare.com from pattern.
   Real tunnel subdomains are 10+ random chars. Prevents matching the
   Cloudflare API endpoint instead of the actual tunnel URL.

2. Session auto-numbering: when user doesn't provide a display_name,
   auto-generate 'project / repo / tool_type #N' where N increments
   for each existing instance with the same project/repo/tool_type.
   Prevents confusing duplicate display names in the sidebar.

These fixes were lost when main's merge was overwritten. Ported to
our clean dev codebase.

Quality gates: py_compile passed, ruff passed on tool_instances.py and tunnel.py.

apps/api/src/services/tunnel.py

@@ -133,7 +133,9 @@ def start_tunnel(
     logger.debug("Tunnel container started: %s", container_id)
 
     # Wait for URL to appear in logs
-    url_pattern = re.compile(r"https://[a-z0-9-]+\.trycloudflare\.com")
+    # Exclude api.trycloudflare.com which is the Cloudflare API endpoint,
+    # not a tunnel URL. Real tunnel URLs have random subdomains (10+ chars).
+    url_pattern = re.compile(r"https://(?!api\.)[a-z0-9-]{10,}\.trycloudflare\.com")
     start_time = __import__("time").time()
     url: str | None = None
     combined_logs = ""