Track cmd/tunneld; scope gitignore to the built binary

The bare 'tunneld' ignore pattern also matched the cmd/tunneld
directory, so the server's main.go was never committed and the
Coolify build failed on COPY cmd. Also update deploy docs for the
Coolify/Traefik topology (API via HTTPS router, tunnel traffic via
TCP SNI passthrough).

AGENTS.md

@@ -47,8 +47,13 @@ what we take vs. skip). Never vendor it into the build.
 - **Deployment**: the multi-stage `Dockerfile` builds a static non-root
   alpine image; verify `CGO_ENABLED=0 go build -trimpath -ldflags="-s -w"
   ./cmd/tunneld` after changing build-affecting code (no Docker runtime on
-  the dev machine). Visitors must reach `tunneld` directly on 443/80 — never
-  behind a TLS-terminating proxy (Coolify's Traefik included).
+  the dev machine). Tunnel visitor traffic must reach the SNI listener
+  without TLS termination (raw TCP, or a Traefik **TCP passthrough** router);
+  the API domain may sit behind a TLS-terminating proxy. On a
+  Coolify-managed host (Traefik owns 443/80): API = app domain → container
+  :8080 with `HTTP_MODE=serve`; tunnel traffic = custom Traefik TCP labels
+  (`HostSNIRegexp` + `tls.passthrough=true`) → container :8443. See README
+  "Deploy on Coolify".
 
 - **macOS system curl (LibreSSL) does not send SNI for `*.localhost` names**,
   so `curl https://api.<id>.localhost:8443/` gets closed (the relay requires