As a user, when I connect to VPN, I want the app to show Connected only when the VPN is actually usable.

Current implementation shows an error after a few minutes when we detect that the tunnel is inactive. That's too late.

AC:

• Update the client apps to display the Connected status only after we confirm the WireGuard tunnel is actually up and passing traffic.
• Add an intermediate Verifying… state between Connect and Connected