feat(FN-2976): detect and display external Tailscale funnel tunnels in remo

Merges external Tailscale funnel detection (FN-2976) — adds types, detection logic, status inclusion, kill flow, and a dedicated UI panel for funnel processes started outside Fusion — alongside custom AI providers API routes and a new settings UI section (FN-2965).

Fusion-Task-Id: FN-2976

docs/architecture.md

@@ -406,8 +406,8 @@ Key server capabilities:
 - System stats snapshot and vitest process controls APIs (`GET /api/system-stats`, `POST /api/kill-vitest`) exposing dashboard process/system telemetry (including host memory rendered as both numeric values and a visual usage bar in the System Stats modal), task/agent aggregates, and manual vitest process termination
 - Remote access APIs (`/api/remote/*`) for provider config, activation, tunnel lifecycle, status, token issuance, authenticated URL generation, and QR payload generation
   - Operational runbook (prereqs/security/troubleshooting): [`docs/remote-access.md`](./remote-access.md)
-  - `/api/remote/tunnel/start` and `/api/remote/tunnel/stop` are the only lifecycle transition endpoints.
-  - `/api/remote/status` includes tunnel status plus restore diagnostics (`restore.outcome` + `restore.reason`) with parity between dashboard and headless `fn serve` runtimes.
+  - `/api/remote/tunnel/start`, `/api/remote/tunnel/stop`, and `/api/remote/tunnel/kill-external` cover tunnel lifecycle and external funnel cleanup.
+  - `/api/remote/status` includes tunnel status, external funnel detection (`externalTunnel` when managed tunnel is stopped), plus restore diagnostics (`restore.outcome` + `restore.reason`) with parity between dashboard and headless `fn serve` runtimes.
 - Remote auth handoff endpoints:
   - `POST /api/remote-access/auth/login-url` (daemon-auth protected) issues a tokenized phone-login URL for either `persistent` or `short-lived` mode.
   - `GET /remote-login?rt=<token>` (public) validates remote token strategy and redirects to dashboard auth handoff (`/?token=<daemonToken>` when daemon auth is enabled, otherwise `/`).

docs/remote-access.md

@@ -147,12 +147,14 @@ Important behavior:
 
 - Start: `POST /api/remote/tunnel/start`
 - Stop: `POST /api/remote/tunnel/stop`
+- Kill external funnel bindings: `POST /api/remote/tunnel/kill-external`
 - Status: `GET /api/remote/status`
 
 Returned status fields include:
 
 - `state`: `stopped | starting | running | stopping | failed`
 - `provider`, `url`, `lastError`, `lastErrorCode`
+- `externalTunnel` (nullable): detected externally-running tunnel metadata (`provider`, `url`) when Fusion-managed tunnel is stopped
 - `restore` diagnostics block (`outcome`, `reason`, `at`, `provider`, optional `message`)
 
 ---
@@ -207,6 +209,8 @@ Supported actions:
 - Save Remote settings (provider config + token strategy)
 - Activate provider
 - Start/Stop tunnel
+- Detect externally-running Tailscale funnel sessions when opening Remote Access settings
+- Use Existing (adopt existing tunnel) or Start Fresh (kill external funnel bindings then start a managed tunnel)
 - Regenerate persistent token
 - Generate short-lived token
 - Show authenticated URL

docs/settings-reference.md

@@ -272,6 +272,8 @@ Use **[Remote Access runbook](./remote-access.md)** for setup prerequisites (Tai
 
 When `remoteAccess.activeProvider` is `cloudflare`, the Settings UI fetches `/api/remote/status` and surfaces `cloudflaredAvailable` to show installed/missing state plus a one-click `POST /api/remote/install-cloudflared` action.
 
+When `remoteAccess.activeProvider` is `tailscale` and the Fusion-managed tunnel is stopped, `/api/remote/status` also returns `externalTunnel` when a pre-existing funnel is detected. The UI exposes two actions: **Use Existing** (start Fusion tunnel lifecycle against the existing funnel) and **Start Fresh** (`POST /api/remote/tunnel/kill-external` then start).
+
 | Setting | Type | Default | Description |
 |---|---|---:|---|
 | `remoteAccess.enabled` | `boolean` | `false` | Master toggle for remote access orchestration. |