fix: feat: move reverse tunnel into disinto-edge container with single-port forward (#622)

- Dockerfile: add openssh-client + autossh to edge image
- entrypoint-edge.sh: start autossh reverse tunnel before Caddy when
  EDGE_TUNNEL_HOST is set; no-op when unset (local-only dev works unchanged)
- generators.sh: pass EDGE_TUNNEL_{HOST,USER,PORT,FQDN} env vars and
  bind-mount secrets/tunnel_key into the edge service

Decommission steps for old host-level reverse-tunnel.service:
  sudo systemctl disable --now reverse-tunnel.service
  sudo rm /etc/systemd/system/reverse-tunnel.service
  sudo systemctl daemon-reload

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

lib/generators.sh

@@ -401,10 +401,16 @@ services:
       - OPS_REPO_ROOT=/opt/disinto-ops
       - PROJECT_REPO_ROOT=/opt/disinto
       - PRIMARY_BRANCH=main
+      # Reverse tunnel (optional — set by `disinto edge register`, see #622)
+      - EDGE_TUNNEL_HOST=${EDGE_TUNNEL_HOST:-}
+      - EDGE_TUNNEL_USER=${EDGE_TUNNEL_USER:-tunnel}
+      - EDGE_TUNNEL_PORT=${EDGE_TUNNEL_PORT:-}
+      - EDGE_TUNNEL_FQDN=${EDGE_TUNNEL_FQDN:-}
     volumes:
       - ./docker/Caddyfile:/etc/caddy/Caddyfile
       - caddy_data:/data
       - /var/run/docker.sock:/var/run/docker.sock
+      - ./secrets/tunnel_key:/run/secrets/tunnel_key:ro
     depends_on:
       - forgejo
       - woodpecker