[AlxcBTW]

Follows anyplaynet/cloud#107 (POST /v1/tunnels/path, counted only).

• Cloud::tunnel_path(direct, upgraded) and the path constant TUNNEL_PATH in the API crate.
• The service sends one report each time a tunnel comes up on, or moves to, a direct or relay path (the same event as the anyplay::path log line), with upgraded when it moved from a relay to a direct path. Fire and forget: no wait, no retry, no message on failure; a cloud without the route (404) is not told and nobody notices.
• No account, peer, address or time in the body.
• Spec: "Tunnel paths" in spec/cloud-api.md, plus the limit row; docs/DESIGN.md updated.
• Unit tests against a fake cloud: the body is {kind, upgraded} only; a cloud without the route answers an error that the service ignores.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}