9811d04c — persist a chosen custom plugin into the tenant's tunnel config.

Body: {"name": str, "command": str|list, "port"?: int, "env"?: {..}}. ?hostname=X scopes it to that machine (else the per-tenant default). The name is validated (safe charset, no built-in slot/plugin collision) and the command must be non-empty; a missing/blank port is auto-assigned. Merges into the existing config (reusing the tunnel_plugins JSON blob — no new table) so resolve_custom_plugins picks it up on the next tunnel (re)start. Returns the updated custom list.