feat(backend): one-command Dockerized cloudflared tunnel

Add `npm run docker:tunnel` (docker-compose.tunnel.yml overlay): a
cloudflared sidecar opens a public quick tunnel to the backend, and the
backend auto-discovers its https://…trycloudflare.com URL from cloudflared's
metrics endpoint (services/relay-url.ts) and bakes it into the wallet-import
QR — so a phone on any network can scan, with no install/account/PUBLIC_RELAY_URL.

PUBLIC_RELAY_URL still wins when set. Verified end-to-end: the backend logs
the discovered tunnel URL on startup.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/env.ts

@@ -25,6 +25,10 @@ const schema = z.object({
   // QR a patient scans. Optional — when unset we derive it from the request host
   // (so opening the web app over the LAN yields a reachable LAN URL).
   PUBLIC_RELAY_URL: z.string().optional(),
+  // Metrics URL of a cloudflared quick-tunnel sidecar (e.g. http://cloudflared:3333).
+  // When set and PUBLIC_RELAY_URL is unset, the backend discovers its public
+  // trycloudflare.com URL from there for Dockerized off-network testing.
+  CLOUDFLARED_METRICS_URL: z.string().optional(),
   PORT: z.coerce.number().int().positive().default(4000),
   NODE_ENV: z
     .enum(["development", "production", "test"])