tunnel: clear stale kill-switch key on subdomain rename

When a user renames their tunnel subdomain, the upsert (onConflict=user_id)
overwrote the tunnels row in place, but the old subdomain's Redis
tunnel:active:<sub> flag was never cleared. The edge tunnel-active gate kept
serving the stale flag for up to its ~30s TTL, after which it fell back to a
Postgres miss and (currently) returned a misleading suspended response.

Capture the user's previous subdomain before the upsert and, when it changes,
DEL the old kill-switch key (new clearTunnelActive helper) so the edge gate
immediately stops treating the old subdomain as a live tunnel.

lib/redis.ts

@@ -169,3 +169,21 @@ export async function setTunnelActive(
     return false;
   }
 }
+
+/**
+ * Clear the live kill-switch flag for a subdomain (DEL tunnel:active:<sub>).
+ * Used when a subdomain is renamed/released so its stale flag does not linger:
+ * with the key gone, the edge gate falls through to its Postgres lookup, finds
+ * no tunnel row, and returns a clean "tunnel not found" instead of the
+ * "suspended: quota exceeded or inactive" page. No-op (false) when REDIS_URL is
+ * unset. Never throws.
+ */
+export async function clearTunnelActive(subdomain: string): Promise<boolean> {
+  if (!process.env.REDIS_URL) return false;
+  if (!subdomain) return false;
+  try {
+    return await redisDel(`tunnel:active:${subdomain}`);
+  } catch {
+    return false;
+  }
+}