For reverse-proxy projects. Legacy projects without a named Local environment get one automatically from their existing target URL. Existing public projects should first POST a local target URL here. Returns the tunnel status plus a self-contained, copy-paste runbook (the instructions field) that an agent runs on a machine that can reach target_url: install frpc, build a small allowlist-restricted local forward proxy, write the config, and run — all outbound-only, no inbound ports.

The tunnel is provisioned lazily on the first call, so instructions is null for the first minute or two while it spins up — keep polling until it is non-null. Once frpc connects, ready flips to true, the project gate opens, and QA starts automatically (no further action). Restrict the forward proxy to the app's host plus any backend/auth/CDN hosts it calls during testing.