feat: add idempotent tunnel connection with state polling and already-running detection

Add tunnel_service_is_active check before Windows tunnel installation to skip if already running. Add is_already_running_error helper to detect "already installed and running" message in WireGuard output. Add wait_for_windows_tunnel_running that polls tunnel state up to 12 times with 500ms intervals after installation. Add describe_windows_tunnel_state for detailed error messages when tunnel fails to reach RUNNING state.

desktop-client/src/App.tsx

@@ -29,6 +29,11 @@ function formatInvokeError(err: unknown, fallback: string) {
   return fallback;
 }
 
+function isAlreadyRunningError(err: unknown) {
+  const message = formatInvokeError(err, "");
+  return message.toLowerCase().includes("already installed and running");
+}
+
 function currentProfileLabel(state: EnrollmentState | null) {
   if (!state) {
     return "Not provisioned";
@@ -189,6 +194,14 @@ export function App() {
         setError(null);
       }
     } catch (err) {
+      if (!connected && isAlreadyRunningError(err)) {
+        const active = await waitForTunnelStatus(true);
+        setConnected(active);
+        if (active) {
+          setError(null);
+          return;
+        }
+      }
       setError(formatInvokeError(err, "Tunnel action failed"));
     }
   }