[tunnel] add CloseConnection method for single connection disconnect

Add CloseConnection(connID string) to TunnelServer that cancels a
single tunnel connection by its ID. Used by tunnelproxy's
TunnelEndpointReconciler to disconnect agents when their infra
Endpoint is externally deleted (GC, manual).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: dilyevsky

pkg/tunnel/server.go

@@ -740,6 +740,15 @@ func (t *TunnelServer) setupConn(
 	return nil
 }
 
+// CloseConnection closes the tunnel connection with the given ID.
+// No-op if the connection does not exist.
+func (t *TunnelServer) CloseConnection(connID string) {
+	if c, exists := t.conns.Get(connID); exists {
+		slog.Info("Closing connection by ID", slog.String("connID", connID))
+		c.cancel()
+	}
+}
+
 // CloseConnectionsByName closes all active connections for the TunnelNode with the given name.
 func (t *TunnelServer) CloseConnectionsByName(name string) {
 	t.conns.ForEach(func(connID string, c *conn) bool {