feat: add tunnel status checking with active interface verification

Add tunnel_status command to desktop client for querying active tunnel state. Add is_active method to tunnel_manager that calls status command on bundled backend. Add status command to tunnel-helper that checks WireGuard service state on Windows via sc query and interface state on macOS via wg show. Add windows_client_status function for IPC-based status queries with active field in TunnelResponse. Update App.tsx to query tunnel status on

desktop-client/src/App.tsx

@@ -51,9 +51,15 @@ export function App() {
 
   useEffect(() => {
     void invoke<EnrollmentState | null>("load_state")
-      .then((value) => {
+      .then(async (value) => {
         if (value) {
           setState(value);
+          try {
+            const active = await invoke<boolean>("tunnel_status");
+            setConnected(active);
+          } catch {
+            setConnected(false);
+          }
         }
       })
       .catch(() => undefined);
@@ -96,8 +102,13 @@ export function App() {
     const command = connected ? "disconnect_tunnel" : "connect_tunnel";
     try {
       await invoke(command);
-      setConnected((value) => !value);
-      setError(null);
+      const active = await invoke<boolean>("tunnel_status");
+      setConnected(active);
+      if (!connected && !active) {
+        setError("Tunnel was installed, but no active interface could be verified yet.");
+      } else {
+        setError(null);
+      }
     } catch (err) {
       setError(formatInvokeError(err, "Tunnel action failed"));
     }