fix(port): add atomic ClaimPort() to prevent race condition

- Replace GetPortStatus/SetPortStatus calls with atomic ClaimPort() operation.
- Fixed a logic error when handling headless tunneling.

session/handler.go

@@ -183,16 +183,11 @@ func (s *SSHSession) HandleTCPForward(req *ssh.Request, addr string, portToBind
 		portToBind = unassigned
 	}
 
-	if isUsed, exists := portUtil.Default.GetPortStatus(portToBind); exists && isUsed {
+	if claimed := portUtil.Default.ClaimPort(portToBind); !claimed {
 		fail(fmt.Sprintf("Port %d is already in use or restricted", portToBind))
 		return
 	}
 
-	if err := portUtil.Default.SetPortStatus(portToBind, true); err != nil {
-		fail(fmt.Sprintf("Failed to set port status: %v", err))
-		return
-	}
-
 	log.Printf("Requested forwarding on %s:%d", addr, portToBind)
 	listener, err := net.Listen("tcp", fmt.Sprintf("0.0.0.0:%d", portToBind))
 	if err != nil {