Expose a container port at a public HTTPS URL

Expose a port on a RUNNING node at a public HTTPS URL, so anything that can curl can reach a server inside the node (TensorBoard, Jupyter, a vLLM endpoint serving a model to a judge). Returns {endpoint_id, url, port, auth, expires_at}. Default auth is the capability URL itself: anyone holding the URL reaches the port, so treat it like a secret. auth:"bearer" additionally requires Authorization: Bearer <token> at the edge; the token rides the response ONCE and is never shown again. The endpoint is bound to the node's current container: node stop kills it, and a wake never resurrects it (re-call expose_port for a fresh URL). Traffic through the endpoint does NOT keep the node awake and is not billed; the server process (a detached run_command) is what holds the node running. Re-calling for an already-exposed port is idempotent: same URL, refreshed expiry. This tool never wakes a stopped node. A run_command wakes it, and the wake bills. Then call expose_port. Raw byte pipe behind the URL: streaming, SSE, and WebSocket all pass through. vanity: "<label>" additionally claims a human-readable hostname (https://<label>.<ingress host>) beside the capability URL - a PUBLIC alias, reachable by name with no secret (bearer auth still enforced), global first-come, freed when the endpoint dies; the same vanity on a re-expose keeps the name.