protocol: add tunnels channel

[Connor Peet (connor4312)]

Summary

• add the experimental ahp-tunnels:// state channel for coordinating client-established port forwards
• model host-to-client and client-to-host mappings with shared requested addresses, per-client lifecycle, and effective ready-state addresses
• add direct set/update/remove actions for ports and participating clients, including multi-client reducer behavior
• generate matching schemas, reference docs, and Rust/Kotlin/Swift/TypeScript/Go/.NET client types and reducers

Why

Remote environments often already provide SSH forwarding, remote-development forwarding, or managed tunnel services. AHP needs shared, replayable state for requesting and coordinating those forwards without prescribing or carrying the data plane itself.

Validation

• npm run generate
• npm test
• TypeScript client tests
• Rust workspace tests
• Kotlin tests
• Go tests
• .NET tests (506 passed)
• generated-output and change-fragment verification

Swift package validation was attempted on Windows. The generated tunnel sources compile, but swift test remains blocked by the pre-existing missing CFGetTypeID / CFBooleanGetTypeID symbols in AnyCodable.swift.