vscode: remote tunnel status + access surfacing

[amrmelsayed]

Depends on the cloud account/tower UI issue. The tunnel itself exists (Tower connects outbound over WebSocket; the cloud proxies the dashboard at a per-tower URL) — this exposes it.

Scope

1. Tunnel status in the sidebar/status bar (connected / reconnecting / off), sourced from Tower's existing cloud-connection state.
2. Enable/disable tunnel commands (driving the Tower/CLI mechanism, not reimplementing).
3. "Open remote dashboard" action → the tower's public tunnel URL; copy-link affordance for access from other devices.

Acceptance

• Tunnel state changes reflect live (reuse existing SSE/connection-manager patterns); links open the authenticated remote dashboard; zero surface when signed out or unregistered.