Fix SSH tunnel not restarted on unexpected process exit

[Copilot]

When the SSH tunnel process crashed, SshTunnelService only logged a warning — it never cleaned up _process/_lastSpec, never fired an event, and never attempted a restart. The gateway client's reconnect loop would spin indefinitely against a dead localhost port.

Changes

SshTunnelService

• Adds TunnelExited event, raised only on unexpected exits (not on intentional Stop())
• On unexpected exit: nulls _process and _lastSpec (so the next EnsureStarted starts fresh), disposes the dead process object (fixes a resource leak), then fires TunnelExited

App.xaml.cs

• Subscribes to TunnelExited at service creation
• OnSshTunnelExited retries EnsureSshTunnelConfigured() with bounded backoff (1 s → 2 s → 5 s → 10 s → 30 s); aborts early if the app is exiting or SSH tunnel is disabled. The gateway client's existing reconnect loop recovers automatically once the tunnel port is live again.

process.Exited += (_, _) =>
{
    if (_stopping) { /* intentional shutdown */ }
    else
    {
        _process = null;
        _lastSpec = null;
        try { process.Dispose(); } catch (Exception ex) { _logger.Warn(...); }
        TunnelExited?.Invoke(this, EventArgs.Empty);
    }
};

[shanselman]

Superseded by PR #141 (merged) — SSH tunnel restart fix.