Increase Go coverage for lifecycle and failure paths

[Luqueee]

Baseline

The Go-only CodeRabbit audit reported 35.1% statement coverage with 140 tests passing across 7 packages. go test -race ./... and go vet ./... passed.

Coverage is especially weak in tunnel and lifecycle code, including tunnel.Manager.Run, Watch, Close, SSH config and auth setup, and config persistence.

Scope

Add meaningful tests for:

• config.Save, clearing values, atomic-write failures, and YAML validation.
• Tunnel creation, reconnect, Run, Watch, Close, auth-agent cleanup, and ProxyJump edge cases.
• Forwarder listener registration, removal, pruning, and shutdown.
• Admin controller failures and HTTP status mapping.
• Clip watcher and server races, cleanup, and permanent error handling.

Acceptance criteria

• Each production bug fixed from the audit has a regression test.
• Coverage is reported in CI for the Go packages.
• The test suite remains race-clean.
• Avoid chasing a percentage without covering the important lifecycle and error branches.