feat(tunnels): add Service type with dynamic env.php endpoint discovery

- Add EnvServicePortResolver (DeploymentConfig) for MySQL, Redis frontends,
  session Redis, AMQP, http_cache_hosts, optional search
- Extend tunnel registry with tunnel_type, service_key, service metadata;
  provisionServiceTunnel without store/NGINX map; teardown guards
- Admin: Type (Website|Service), service dropdown, list Type column; JS toggle
- TunnelManager/start-server: forward to resolved host:port
- Tests: EnvServicePortResolver + service teardown; test stubs for Magento/PSR
- docs: admin-ui Type/Service and security notes

docs/admin-ui.md

@@ -16,17 +16,20 @@ The same URL shows two in-page tabs: **Tunnels list** (grid, log tails, start/st
 
 **Tunnel table**
 
-- Lists all tunnels from [`TunnelRegistry`](../Magesail/Model/TunnelRegistry.php) (`var/magesail_tunnels.json`): label, **store code**, **local port**, hostname, run/stop state, Holesail key (when running), and actions.
+- Lists all tunnels from [`TunnelRegistry`](../Magesail/Model/TunnelRegistry.php) (`var/magesail_tunnels.json`): **Type** (**Website** vs **Service**), label, **store code** (em dash for service tunnels), **local port**, host/target, run/stop state, Holesail key (when running), and actions.
+- **Website** tunnels — dedicated store view, base URLs, optional NGINX global map (same as before).
+- **Service** tunnels — TCP forward to an endpoint discovered from `app/etc/env.php` by [`EnvServicePortResolver`](../Magesail/Model/EnvServicePortResolver.php): MySQL (`db/connection/default`, default port **3306** if omitted), each Redis `cache/frontend/*` backend, session Redis when `session.save` is `redis`, `queue/amqp`, each `http_cache_hosts` entry, and optional Elasticsearch/OpenSearch under `catalog/search` when host and port are set. No store view and no NGINX map row. The Node script forwards to `service_target_host:local_port` (see [`start-server.js`](../Magesail/scripts/start-server.js) `forwardHost`). **Security:** exposing databases, Redis, or AMQP over Holesail is sensitive—use **Holesail secure tunnel**, restrict Admin ACL, and use normal client credentials from env (passwords are not shown in the Admin UI).
 - **Start** — starts the Node process for that tunnel only (uses saved port and Holesail secure flag). No re-provisioning.
 - **Stop** — stops the Node process and removes that tunnel’s PID/key files; **registry row, store view, and NGINX map line stay** so you can start again.
-- **Remove** — stops the process if needed, removes the NGINX map entry, deletes the store view when safe, and removes the tunnel from the registry.
+- **Remove** — **Website**: stops the process if needed, removes the NGINX map entry, deletes the store view when safe, and removes the tunnel from the registry. **Service**: removes registry row and PID/key files only (no store).
 - **Cron (dead process)** — If **Auto-restart on crash** is **No** under **MageSail → Holesail Tunnel → Configuration**, the **daily** monitor applies the same **Remove**-style teardown to any tunnel whose PID file exists but the process is no longer running (see [cron-and-monitoring.md](cron-and-monitoring.md)).
 - Each row can expand **Log tail** for `var/log/magesail_tunnel_<id>.log`.
 - **Copy actions** — Clipboard helper [`magesail-clipboard.js`](../Magesail/view/adminhtml/web/js/magesail-clipboard.js): **Copy** beside **store code**; **Copy key** and **Copy command** (full `holesail …` line) when the tunnel is running and the key is present; **Copy log** above the log tail. Success and failure are shown on the **button** (short label swap and highlight, then restore)—not the top banner. Keys are sensitive—treat them like passwords (see How-To **Security**).
 
 **Add tunnel** (Add a tunnel tab — new tunnel)
 
-- **Website** and **Store group** — required; the new dedicated store view is created under that scope.
+- **Type** — **Website** (default): current Magento tunnel form. **Service**: choose one discovered TCP service (dropdown built from env); optional label; **Holesail secure tunnel** applies to both. If nothing is discoverable in env, the Service flow cannot be submitted.
+- **Website** and **Store group** — required when Type is **Website**; the new dedicated store view is created under that scope.
 - **Local port** — preset **443**, **80**, or **8080**, or **Custom…** with any port **1–65535**. Multiple tunnels may use the same port in configuration; whether more than one Node process can bind depends on the OS (see field note in Admin).
 - **Tunnel hostname (unsecure)** — required; hostname only (e.g. `dev.myshop.local`); stored as `http://host/`. Must match the browser / Holesail client vhost.
 - **Tunnel hostname (secure, optional)** — same rules; stored as `https://host/` when set.
@@ -36,7 +39,7 @@ The same URL shows two in-page tabs: **Tunnels list** (grid, log tails, start/st
 
 **AJAX / JSON**
 
-- `action=start` — without `tunnel_id`: create new tunnel (all Add-tunnel fields). With `tunnel_id`: start existing stopped tunnel only.
+- `action=start` — without `tunnel_id`: create new tunnel (`tunnel_add_type` = `website` or `service`; service submits `service_key`). With `tunnel_id`: start existing stopped tunnel only.
 - `action=stop` — requires `tunnel_id`.
 - `action=delete` — requires `tunnel_id` (full teardown).