fix: turn VPN off on sleep/resume and unload; harden teardown

- Detect resume (boottime-monotonic jump) and tear down the tunnel: on wake
  NetworkManager drops Mudfish's relay route and all traffic black-holes.
- Turn the tunnel off on plugin unload (Deck shutdown/restart).
- One verified teardown path for disconnect, connect failure/timeout and
  node-change failure; keep the route snapshot if tap0 stays up.
- Toggle can always turn off a stuck tunnel; status failure with tap0 up
  is reported as an error, not off.
- Re-sign in once when the cloud rejects an expired jwt.
- Expire cached pings after 10 minutes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

main.py

@@ -12,6 +12,8 @@ from mudfish_decky.client import MudfishClient  # noqa: E402
 from mudfish_decky.controller import Controller  # noqa: E402
 from mudfish_decky.store import Store  # noqa: E402
 
+RESUME_POLL_SECONDS = 2
+
 
 class Plugin:
     controller = None
@@ -44,9 +46,18 @@ class Plugin:
         log.setLevel(logging.INFO)
         for handler in decky.logger.handlers:
             log.addHandler(handler)
+        controller = self._get_controller()
         # Bring up the idle launcher and sign in so nodes are listed. Never starts the tunnel.
-        await asyncio.to_thread(self._get_controller().prepare)
+        await asyncio.to_thread(controller.prepare)
         decky.logger.info("Mudfish VPN plugin loaded")
+        # Watch for sleep/resume even while the panel is closed; a resumed tunnel is turned off.
+        while True:
+            try:
+                await asyncio.to_thread(controller.check_resume, system.sleep_offset())
+            except Exception as e:
+                decky.logger.warning("resume check failed: %s", e)
+            await asyncio.sleep(RESUME_POLL_SECONDS)
 
     async def _unload(self):
+        await asyncio.to_thread(self._get_controller().shutdown)
         decky.logger.info("Mudfish VPN plugin unloaded")