feat(cistech-tunnel): add auto-connect, menu flag, watchdog, fix host routing

- Auto-connect on startup (skip with -m/--menu flag)
- Add VPN watchdog for auto-reconnect
- Add live TOTP display
- Fix host-routing.sh pipefail issue with grep
- Better forwarding rules similar to rego-tunnel

apps/cistech-tunnel/shared/host-routing.sh

@@ -93,8 +93,8 @@ remove_all() {
     done
 
     # Remove masquerade rule (using nft)
-    local handle
-    handle=$(nft -a list chain ip nat POSTROUTING 2>/dev/null | grep "saddr $LAN_SUBNET.*oifname.*$BRIDGE_NAME.*masquerade" | grep -oP 'handle \K\d+' | head -1)
+    local handle=""
+    handle=$(nft -a list chain ip nat POSTROUTING 2>/dev/null | grep "saddr $LAN_SUBNET.*oifname.*$BRIDGE_NAME.*masquerade" | grep -oP 'handle \K\d+' | head -1 || true)
     if [ -n "$handle" ]; then
         nft delete rule ip nat POSTROUTING handle "$handle" 2>/dev/null || true
     fi