feat: add tunnel status checking with active interface verification

Add tunnel_status command to desktop client for querying active tunnel state. Add is_active method to tunnel_manager that calls status command on bundled backend. Add status command to tunnel-helper that checks WireGuard service state on Windows via sc query and interface state on macOS via wg show. Add windows_client_status function for IPC-based status queries with active field in TunnelResponse. Update App.tsx to query tunnel status on

desktop-client/src-tauri/src/lib.rs

@@ -304,6 +304,13 @@ fn disconnect_tunnel(app: AppHandle, state: State<'_, AppState>) -> Result<(), S
     tunnel_manager::disconnect(&app, std::path::Path::new(&session.profile_path))
 }
 
+#[tauri::command]
+fn tunnel_status(app: AppHandle, state: State<'_, AppState>) -> Result<bool, String> {
+    let session = state.session.lock().map_err(|_| "Unable to read client state".to_string())?;
+    let session = session.as_ref().ok_or_else(|| "No active session is available".to_string())?;
+    tunnel_manager::is_active(&app, std::path::Path::new(&session.profile_path))
+}
+
 fn generate_keypair() -> (String, String) {
     let private = StaticSecret::random_from_rng(OsRng);
     let public = PublicKey::from(&private);
@@ -431,7 +438,7 @@ pub fn run() {
             }
             _ => {}
         })
-        .invoke_handler(tauri::generate_handler![load_state, clear_session, enroll_device, sync_profile, connect_tunnel, disconnect_tunnel])
+        .invoke_handler(tauri::generate_handler![load_state, clear_session, enroll_device, sync_profile, connect_tunnel, disconnect_tunnel, tunnel_status])
         .run(tauri::generate_context!())
         .expect("error while running tauri application");
 }

desktop-client/src-tauri/src/tunnel_manager.rs

@@ -47,6 +47,23 @@ pub fn disconnect(app: &AppHandle, profile_path: &Path) -> Result<(), String> {
     Ok(())
 }
 
+pub fn is_active(app: &AppHandle, profile_path: &Path) -> Result<bool, String> {
+    let backend = bundled_backend(app)?;
+    let output = Command::new(backend)
+        .arg("status")
+        .arg("--profile")
+        .arg(profile_path)
+        .output()
+        .map_err(|err| format!("Unable to query embedded tunnel backend: {}", err))?;
+
+    if !output.status.success() {
+        return Err(format_helper_error("status", &output));
+    }
+
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    Ok(stdout.trim().eq_ignore_ascii_case("active"))
+}
+
 fn bundled_backend(app: &AppHandle) -> Result<PathBuf, String> {
     let resource_dir = app
         .path()