fix(tunnel): preserve successor cloudflared PID

Make PID cleanup conditional on the exiting child still owning the PID file so a stale exit cannot erase a replacement tunnel's PID. Only null the in-memory process when the exiting child is current. Explicit disable keeps unconditional cleanup.

src/lib/tunnel/cloudflare/cloudflared.js

@@ -239,8 +239,8 @@ export async function spawnCloudflared(tunnelToken) {
     });
 
     child.on("exit", (code, signal) => {
-      cloudflaredProcess = null;
-      clearPid();
+      if (cloudflaredProcess === child) cloudflaredProcess = null;
+      clearPid(child.pid);
       const wasConnected = resolved; // true = already connected successfully
       if (!resolved) {
         resolved = true;
@@ -372,8 +372,8 @@ export async function spawnQuickTunnel(localPort, onUrlUpdate) {
     });
 
     child.on("exit", (code, signal) => {
-      cloudflaredProcess = null;
-      clearPid();
+      if (cloudflaredProcess === child) cloudflaredProcess = null;
+      clearPid(child.pid);
       // Deliberate kill (restart/disable) — exit silently, no error noise
       if (intentionalKill) {
         intentionalKill = false;

src/lib/tunnel/cloudflare/pid.js

@@ -16,8 +16,12 @@ export function loadPid() {
   return null;
 }
 
-export function clearPid() {
+export function clearPid(expectedPid = null) {
   try {
-    if (fs.existsSync(PID_FILE)) fs.unlinkSync(PID_FILE);
+    if (!fs.existsSync(PID_FILE)) return false;
+    if (expectedPid !== null && loadPid() !== expectedPid) return false;
+    fs.unlinkSync(PID_FILE);
+    return true;
   } catch { /* ignore */ }
+  return false;
 }