feat: restart tunnels from web panel

[dr-hoseyn]

Summary

• add a Restart action to every tunnel card in the web panel
• require confirmation and show restarting, success, and failure feedback in place
• add Persian translations and keep the three-button card responsive on mobile
• document that the monitoring-focused panel can restart, but not reconfigure, tunnels

Backend and security

• add POST /api/tunnels/restart behind full panel-session authentication
• keep the read-only remote monitoring token unable to restart services
• accept only exact tunnel names returned by manage.List() and use their configured service names
• reject missing/unknown names and avoid exposing internal systemd errors

Testing

• gofmt and git diff --check
• GOOS=linux GOARCH=amd64 go vet ./internal/webui
• GOOS=linux GOARCH=amd64 go test -c ./internal/webui
• parsed the embedded dashboard JavaScript with Node
• visually checked the tunnel card at desktop width and a 390px mobile viewport
• added handler/security and dashboard-behavior tests

This is intentionally separate from #9 so port-editing UX and web-panel restart can be reviewed and merged independently.