Return whether the tenant currently has an active tunnel socket.

89a06e40 — request is a NEW parameter (this route previously took only tenant_id), added to reach request.app.state.db for the profile_binding field below. Defaulted to None rather than made required: several existing tests (test_slot_reprobe.py, test_tunnel_bridge.py, test_w5_9665538a_meridian_docs_slot.py) call this function directly as a plain coroutine (tn.tunnel_status(tid)), not through FastAPI's HTTP layer — FastAPI still injects the real Request for actual HTTP calls regardless of the default (it recognizes the Request type annotation, not the absence of a default), so this stays a non-breaking change for both calling styles. profile_binding degrades to None (see below) when request is None, exactly like every other best-effort field in this response.

4bea8629 — SECURITY FIX: this route previously had NO auth at all (see the "no auth required" note that used to head this section), unlike its documentary-tenant_id siblings /tunnel/diagnostics/{tenant_id} and /tunnel/launch-matrix/{tenant_id} (which resolve the REAL caller via _get_tenant_from_request and treat the path's tenant_id as informational only). Anyone who knew or guessed a tenant_id could fetch this response — live per-slot health, config generation, and in-flight request counts for that tenant. Fix: in hosted mode, resolve the caller's own tenant the same way, and hard-require it match the path's tenant_id (mirroring tunnel_ws's own WS-side check and the tunnel HTTP/WS proxy routes' 5de3d422 fix). A direct, non-HTTP call (request is None — see above) is unaffected, same as the profile_binding degrade. /tunnel/openai/diagnostics/{tenant_id} is intentionally unauthenticated per its own docstring and is NOT touched by this fix.