feat: sync profile before connection and apply current policy to enrollment responses

Add applyCurrentPolicy function to resolve and apply policy destinations to enrollment responses with fallback to 172.16.10.0/24 when no destinations exist. Replace withDebugProfile calls with applyCurrentPolicy in GetLatestEnrollmentByUser and GetEnrollmentByDeviceID. Extract sync_current_session helper function to deduplicate profile sync logic between sync_profile and connect_tunnel commands. Update connect

desktop-client/src/App.tsx

@@ -183,7 +183,12 @@ export function App() {
   async function toggleConnection() {
     const command = connected ? "disconnect_tunnel" : "connect_tunnel";
     try {
-      await invoke(command);
+      if (!connected) {
+        const syncedState = await invoke<EnrollmentState>("connect_tunnel");
+        setState(syncedState);
+      } else {
+        await invoke(command);
+      }
       const active = await waitForTunnelStatus(!connected);
       setConnected(active);
       if (!connected && !active) {