chore(security): Improve security docs and tighten JWT audience

Stainless-Generated-From: 8076923f9d8292b27cc565c0aef7e35567853004

Author: stlc-bot

scripts/mock

@@ -926,10 +926,12 @@ def enable_tunnel(
         URL-based access to the Devbox without exposing internal IDs. The tunnel URL
         format is: https://{port}-{tunnel_key}.tunnel.runloop.ai
 
-        Each Devbox can have one tunnel.
+        Each Devbox can have one tunnel. If tunnel config is omitted, or auth_mode is
+        omitted, the tunnel defaults to open (public hostname, no bearer token).
 
         Args:
-          auth_mode: Authentication mode for the tunnel. Defaults to 'public' if not specified.
+          auth_mode: Authentication mode for the tunnel. Defaults to open if omitted: the hostname is
+              a public capability and does not require a tunnel bearer token.
 
           http_keep_alive: When true, HTTP traffic through the tunnel counts as activity for idle lifecycle
               policies, resetting the idle timer. Defaults to true if not specified.
@@ -2762,10 +2764,12 @@ async def enable_tunnel(
         URL-based access to the Devbox without exposing internal IDs. The tunnel URL
         format is: https://{port}-{tunnel_key}.tunnel.runloop.ai
 
-        Each Devbox can have one tunnel.
+        Each Devbox can have one tunnel. If tunnel config is omitted, or auth_mode is
+        omitted, the tunnel defaults to open (public hostname, no bearer token).
 
         Args:
-          auth_mode: Authentication mode for the tunnel. Defaults to 'public' if not specified.
+          auth_mode: Authentication mode for the tunnel. Defaults to open if omitted: the hostname is
+              a public capability and does not require a tunnel bearer token.
 
           http_keep_alive: When true, HTTP traffic through the tunnel counts as activity for idle lifecycle
               policies, resetting the idle timer. Defaults to true if not specified.

src/runloop_api_client/resources/devboxes/devboxes.py

@@ -142,7 +142,11 @@ class Tunnel(TypedDict, total=False):
     """
 
     auth_mode: Optional[Literal["open", "authenticated"]]
-    """Authentication mode for the tunnel. Defaults to 'public' if not specified."""
+    """Authentication mode for the tunnel.
+
+    Defaults to open if omitted: the hostname is a public capability and does not
+    require a tunnel bearer token.
+    """
 
     http_keep_alive: Optional[bool]
     """

src/runloop_api_client/types/devbox_create_params.py

@@ -10,7 +10,11 @@
 
 class DevboxEnableTunnelParams(TypedDict, total=False):
     auth_mode: Optional[Literal["open", "authenticated"]]
-    """Authentication mode for the tunnel. Defaults to 'public' if not specified."""
+    """Authentication mode for the tunnel.
+
+    Defaults to open if omitted: the hostname is a public capability and does not
+    require a tunnel bearer token.
+    """
 
     http_keep_alive: Optional[bool]
     """