fix(handler/tunnel): respect user-supplied host in handleBind, add ingress conflict detection

The response address sent back to the tunnel client was unconditionally
set to the md5 hash of the tunnel ID. This meant the user's custom host
(e.g. "dash" from "dash:8081") was ignored — the client listened on
the hash instead.

Now the user-supplied host is used directly when:
1. A host is present in the bind address AND ingress is configured.
2. No other tunnel has already claimed that host in ingress
   (conflict check via GetRule).

Fall back to the md5 hash when no host is supplied, ingress is nil, or
the host conflicts with an existing ingress rule.

Also fixes indentation in the WriteTo error handling block (extra tab
removed).

Tests:
- TestHandleBind_CustomHost: response AddrFeature uses "dash", not hash
- TestHandleBind_CustomHostConflict: conflicting host falls back to hash
- fakeIngress enhanced with ruleByHost map for conflict simulation

handler/tunnel/connect_test.go

@@ -23,11 +23,18 @@ func (b *fakeBypass) Contains(ctx context.Context, network, addr string, opts ..
 }
 
 // fakeIngress implements ingress.Ingress for testing.
+// It stores one rule per hostname for conflict simulation.
 type fakeIngress struct {
-	rule *ingress.Rule
+	rule     *ingress.Rule
+	ruleByHost map[string]*ingress.Rule
 }
 
 func (i *fakeIngress) GetRule(ctx context.Context, host string, opts ...ingress.Option) *ingress.Rule {
+	if i.ruleByHost != nil {
+		if r, ok := i.ruleByHost[host]; ok {
+			return r
+		}
+	}
 	return i.rule
 }