fix: tunnel reconnection stability and manual pairing reliability

[comlibmb]

Summary

Multiple fixes for tunnel reconnection stability when using cloudflared quick tunnels.

Changes

1. Tunnel Notifier (src/tunnel-notifier.ts)

   • Normalize tunnel URL to wss:// format before storing in Supabase
   • Add 5-retry with exponential backoff for Supabase upsert failures
   • Preserve existing pairing_code on tunnel restart (don't overwrite to null)

2. Session Preservation (src/index.ts, src/tools/claude-process.ts)

   • Distinguish graceful disconnect vs network interruption
   • Network interruption: keep taken-over sessions for 5 min TTL
   • Cancel TTL timer when mobile reconnects

3. Environment Variables (src/tunnel-notifier.ts, src/index.ts)

   • Move Supabase credentials from hardcoded to env vars (FORKOFF_SUPABASE_URL, FORKOFF_SUPABASE_ANON_KEY)
   • Add dotenv for .env file loading
   • Add .env.example template

Bug Fixes

• Tunnel restart caused pairing_code to be cleared from Supabase, breaking manual pairing
• Network interruption immediately cleared all sessions, requiring re-take-over on reconnect
• Supabase update failures with no retry caused mobile to never learn new tunnel URL

Test Plan

• Kill cloudflared → CLI restarts tunnel → mobile auto-reconnects
• Manual pairing code works after tunnel restart
• Sessions preserved after brief disconnect
• E2EE re-established after reconnect