generalize tunnel-watch into tunnel-nats

takes a subcommand, e.g.:

    cf tunnel-nats some-director.com watch
    cf tunnel-nats some-director.com watch appname
    cf tunnel-nats some-director.com dea-ads