revert: cloudflared tunnel localhost fix — wrong diagnosis

The API container and tool instances share the 'backend' Docker network
(connect_container_to_network at tool_instances.py:1576). cloudflared
runs INSIDE the api container, so localhost:host_port is unreachable.

The original container_name:internal_port is correct for networking.
The 'app error 0' is an application-level issue, not networking.

This reverts commit a8fbca9.

apps/api/src/services/docker.py

@@ -385,15 +385,16 @@ def find_free_port(start: int = 10000, end: int = 20000) -> int:
 
 
 def start_cloudflared_tunnel(
-    host_port: int, timeout: int = 30
+    container_name: str, port: int, timeout: int = 30
 ) -> dict[str, str]:
-    """Start a temporary Cloudflare tunnel to localhost.
+    """Start a temporary Cloudflare tunnel for a container.
 
     Uses 'cloudflared tunnel --url' to create a temporary tunnel
     with a random trycloudflare.com URL.
 
     Args:
-        host_port: Host-mapped port number (e.g. from find_free_port)
+        container_name: Name of the Docker container to tunnel to
+        port: Port number the container listens on
         timeout: Maximum seconds to wait for tunnel URL
 
     Returns:
@@ -404,8 +405,8 @@ def start_cloudflared_tunnel(
 
     logger = logging.getLogger(__name__)
 
-    # First verify the container is accessible via the host-mapped port
-    logger.info("Checking connectivity to localhost:%d...", host_port)
+    # First verify the container is accessible
+    logger.info("Checking connectivity to %s:%d...", container_name, port)
     for attempt in range(10):
         check = subprocess.run(
             [
@@ -415,7 +416,7 @@ def start_cloudflared_tunnel(
                 "/dev/null",
                 "-w",
                 "%{http_code}",
-                f"http://localhost:{host_port}",
+                f"http://{container_name}:{port}",
             ],
             capture_output=True,
             text=True,
@@ -429,13 +430,13 @@ def start_cloudflared_tunnel(
         time.sleep(1)
     else:
         logger.warning(
-            "localhost:%d not responding to curl checks", host_port
+            "Container %s:%d not responding to curl checks", container_name, port
         )
 
     # Run cloudflared in background, capture output
-    logger.info("Starting cloudflared tunnel to http://localhost:%d", host_port)
+    logger.info("Starting cloudflared tunnel to http://%s:%d", container_name, port)
     proc = subprocess.Popen(
-        ["cloudflared", "tunnel", "--url", f"http://localhost:{host_port}"],
+        ["cloudflared", "tunnel", "--url", f"http://{container_name}:{port}"],
         stdout=subprocess.PIPE,
         stderr=subprocess.STDOUT,
         text=True,
@@ -490,14 +491,15 @@ def stop_cloudflared_tunnel(pid: str) -> None:
 
 
 def recreate_tunnel(
-    host_port: int, old_pid: str | None = None
+    container_name: str, port: int, old_pid: str | None = None
 ) -> dict[str, str]:
     """Recreate a temporary Cloudflare tunnel.
 
     Stops the old tunnel (if pid provided) and starts a new one.
 
     Args:
-        host_port: Host-mapped port number (e.g. from find_free_port)
+        container_name: Name of the Docker container to tunnel to
+        port: Port number the container listens on
         old_pid: Optional PID of the old tunnel process to stop
 
     Returns:
@@ -506,7 +508,7 @@ def recreate_tunnel(
     if old_pid:
         stop_cloudflared_tunnel(old_pid)
 
-    return start_cloudflared_tunnel(host_port)
+    return start_cloudflared_tunnel(container_name, port)
 
 
 def check_tunnel_health(url: str, timeout: int = 10) -> dict[str, Any]: