chore: lock the plugin boundary and remove 2.9.0 leftovers

plugins/tunnels/src/backend/c2s-relay.ts

@@ -204,6 +204,7 @@ export function createC2SRelay(ctx: PluginContext) {
   function connectSource(hostId: number): Promise<PluginSshConnection<Client>> {
     return ctx.ssh.connect<Client>(hostId, {
       purpose: "tunnel",
+      profile: "forward",
       timeoutMs: 60_000,
     });
   }

plugins/tunnels/src/backend/manager.ts

@@ -190,6 +190,7 @@ export function createTunnelManager(ctx: PluginContext) {
     return ctx.asUser(userId, () =>
       ctx.ssh.connect<Client>(hostId, {
         purpose: "tunnel",
+        profile: "forward",
         timeoutMs: CONNECT_TIMEOUT_MS,
         sock,
       }),