fix: VPN IP dedup, status polling, pair-a-device text

- VPN status: don't show WG IP as NostrVPN IP when tunnel not up
- VPN section polls every 15s so IP updates after pairing
- NostrVPN shows "Pair a device" when service active but no tunnel

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

core/archipelago/src/api/rpc/vpn.rs

@@ -46,11 +46,17 @@ impl RpcHandler {
         let wg_pubkey = tokio::fs::read_to_string("/var/lib/archipelago/wireguard/public.key")
             .await.ok().map(|s| s.trim().to_string());
 
+        // Don't report NostrVPN ip_address if it's the same as WireGuard (means tunnel not up)
+        let nvpn_ip = status.ip_address.as_ref().and_then(|ip| {
+            let clean = ip.split('/').next().unwrap_or(ip);
+            if wg_ip.as_deref() == Some(clean) { None } else { Some(ip.clone()) }
+        });
+
         Ok(serde_json::json!({
             "connected": status.connected || wg_ip.is_some(),
             "provider": status.provider,
             "interface": status.interface,
-            "ip_address": status.ip_address,
+            "ip_address": nvpn_ip,
             "hostname": status.hostname,
             "peers_connected": status.peers_connected,
             "bytes_in": status.bytes_in,