fix: code scanning alert 9 in draw tunnel detection

[jbeckwith-oai]

Summary

• replace shell-based command detection with PATH and executable checks
• add a lightweight Node test for preferred tunnel detection
• add a draw test script for server-side checks

Root Cause

The draw tunnel helper built a shell command with the requested backend name and ran command -v through execSync. That made the backend string shell-interpreted.

Validation

• npm test