A switch to public ports that fails after both Doors open can't be walked back to the tunnel#4097

Found while fixing #4026 (PR #4095).

With Cloudflare active, a switch to public ports opens [public, tunnel] first. If it then fails before the source flips for a reason other than a collision (a Server didn't answer, so the frame is partial or silent; an unaccounted name; doorsGap on the first open), the attempt is failed with want = public, the source is still active and the public Door stays open. switchProblem (dashboard/src/modules/ingress/doors.ts) lets an active-source tunnel request through only when the failed attempt wanted tunnel, and WebTrafficSection.tsx follows the same predicate, so the user can retry public but cannot return to tunnel-only from the dashboard.

Covered today by the postgres test 'stops the same way when the frame missed a Server' (active, public: sets [public, tunnel], source stays active).

Triage: F 2 (needs a Server to drop out mid-switch on a rarely made switch), S 5 (broken flow with a workaround: retry public, or close the Door with the Engine CLI). F×S = 10, so filed rather than fixed. Likely fix: let switchProblem accept a tunnel request on an active source after a failed attempt of either direction, plus the same in the UI's can-switch predicate.