Permanent Cloudflare setup does not safely reuse existing tunnels #5

Setup path

scripts/setup-cloudflare-remote-access.sh configure-permanent --hostname ... --tunnel-name codepilot and the Mac Cloudflare wizard permanent-hostname flow.

Friction

Docs and wizard copy say the setup can create or reuse a tunnel. The script currently runs cloudflared tunnel create "$tunnel_name" 2>&1 || true, parses an ID from that output, and continues. If the tunnel already exists or creation fails without an ID, the script can proceed with an empty tunnel_id and write a config with credentials-file: ~/.cloudflared/.json. That leaves users with a broken LaunchAgent/config instead of a reusable tunnel or a specific recovery action.

Expected

Either:

• Detect and reuse an existing tunnel by name and write the correct credentials file, or
• Stop before writing config when no tunnel ID can be determined, with recovery copy telling the user to choose another tunnel name or clean up the existing tunnel.

Add tests for the existing-tunnel/no-ID path.