refactor: update bundled binary path and add tunnel status polling with retry logic

Change NSIS installer hooks to use bundled/ instead of resources/bundled/ path for tunnel helper executable. Add waitForTunnelStatus helper that polls tunnel status up to 8 times with 500ms intervals to verify expected state after connect/disconnect operations. Update toggle handler to use polling instead of single status check and add error message for failed disconnect operations.

desktop-client/src/App.tsx

@@ -67,6 +67,25 @@ export function App() {
 
   const profileLabel = useMemo(() => currentProfileLabel(state), [state]);
 
+  async function waitForTunnelStatus(expected: boolean) {
+    for (let attempt = 0; attempt < 8; attempt += 1) {
+      try {
+        const active = await invoke<boolean>("tunnel_status");
+        if (active === expected) {
+          return active;
+        }
+      } catch {
+        if (!expected) {
+          return false;
+        }
+      }
+
+      await new Promise((resolve) => window.setTimeout(resolve, 500));
+    }
+
+    return invoke<boolean>("tunnel_status").catch(() => false);
+  }
+
   async function onSubmit(event: FormEvent) {
     event.preventDefault();
     setLoading(true);
@@ -102,10 +121,12 @@ export function App() {
     const command = connected ? "disconnect_tunnel" : "connect_tunnel";
     try {
       await invoke(command);
-      const active = await invoke<boolean>("tunnel_status");
+      const active = await waitForTunnelStatus(!connected);
       setConnected(active);
       if (!connected && !active) {
         setError("Tunnel was installed, but no active interface could be verified yet.");
+      } else if (connected && active) {
+        setError("Tunnel could not be stopped cleanly yet.");
       } else {
         setError(null);
       }