feat: add tunnel status checking with active interface verification

Add tunnel_status command to desktop client for querying active tunnel state. Add is_active method to tunnel_manager that calls status command on bundled backend. Add status command to tunnel-helper that checks WireGuard service state on Windows via sc query and interface state on macOS via wg show. Add windows_client_status function for IPC-based status queries with active field in TunnelResponse. Update App.tsx to query tunnel status on

deploy/scripts/gateway-entrypoint.sh

@@ -143,6 +143,7 @@ EOF
 
   echo "Applied WireGuard config from ${WG_CONF}"
   echo "Applied nftables config from ${NFT_CONF}"
+  wg show "${IFACE}" latest-handshakes transfer 2>/dev/null || true
 }
 
 while true; do