Expose a Runloop devbox port publicly (or with auth) via a tunnel URL for live previews and webhooks

Documented steps

1. Enable a tunnel at devbox creation: Python `devbox = await runloop.devbox.create(tunnel={"auth_mode": "open"}, entrypoint="python3 -m http.server 8080 --bind 0.0.0.0")`, then `tunnel_url = await devbox.get_tunnel_url(8080)`.
2. Or enable on a running devbox: `tunnel = await devbox.net.enable_tunnel(auth_mode="open")`, then `url = await devbox.get_tunnel_url(8080)`.
3. Tunnel URLs follow the pattern `https://{port}-{tunnel_key}.tunnel.runloop.ai`; change the port segment to reach other listening ports on the same devbox.
4. Services MUST bind to 0.0.0.0 (not localhost/127.0.0.1) to be reachable through the tunnel. Supports HTTP/HTTPS, WebSockets, and Server-Sent Events.
5. For restricted access use `auth_mode="authenticated"`; requests then require `curl -H "Authorization: Bearer <token>" https://8080-<key>.tunnel.runloop.ai`.
6. Only one active tunnel is supported per devbox; tunnel information is preserved across suspend/resume cycles.
7. 'Wake-on-HTTP' auto-resumes a suspended devbox on an incoming tunnel request, returning 503 with a Retry-After header while it wakes up.
8. WebSocket apps that validate Origin headers must allow-list `https://*.tunnel.runloop.ai` since tunnel traffic arrives with that origin.
9. For a fronting/branded proxy, Runloop resolves the target host from the `X-Runloop-Host` header first, then the `Host` header — this only works with authenticated tunnels and a valid bearer token.
10. Docs: https://docs.runloop.ai/docs/devboxes/tunnels