feat(reach): add --extra-port for ad-hoc port publishing on create

[todie]

Summary

Add `reach create --extra-port HOST:CONTAINER` (repeatable) so callers can publish additional ports from the sandbox to the host beyond the built-in vnc/novnc/health trio.

```
reach create --name todie-poster --extra-port 9222
reach create --name foo --extra-port 8080:80 --extra-port 9229:9229
```

Single-port shorthand (`--extra-port 9222`) expands to `9222:9222`.

Why

Driven by a real workflow: a host process needs to drive Chrome's remote debugging port (CDP) inside the sandbox so the host daemon can connect to a browser running under the reach desktop.

Without extra-port mapping the only options are:

1. Recreating the container manually with `docker run -p` — loses all reach lifecycle management.
2. Routing through the docker bridge IP — blocked under WSL2 + Docker Desktop, where the host can't reach 172.17.0.x directly.

Implementation

• `SandboxPorts.extra: Vec<(u16, u16)>` carries the extra pairs through the create pipeline.
• `SandboxPortMapping.extra` round-trips through the JSON serializer (skipped when empty so existing consumers see no change).
• `extract_ports` in `docker.rs` recovers extras from `docker ps` output for already-running containers.
• `reach create` summary prints any extras under an "Extra:" line.
• `parse_port_pair` validator on the clap arg gives clean error messages on malformed input.

Test plan

• `cargo fmt --all -- --check` clean
• `cargo build --release -p reach-cli` succeeds
• `cargo test -p reach-cli --release` — all 23 unit tests pass (existing JSON test unchanged)
• Manual e2e: `reach create --name pf --extra-port 9222 && curl http://localhost:9222/json/version\`

🤖 Generated with Claude Code