Address PR review: free FFI result pointers + widen VPN guard

- Free the C string returned by clearTunnelCache/runURLTests/sendConfigRequest
  in a finally block; toDartString() only converts, so these were leaking the
  C.CString("ok") allocation on every call.
- Gate refresh-configuration on `!= VPNStatus.disconnected` so connecting,
  disconnecting, missingPermission and error states are also blocked, since
  clearing the tunnel cache requires the tunnel to be fully stopped.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: jigar-f

lib/features/support/support.dart

@@ -163,8 +163,12 @@ class Support extends ConsumerWidget {
     BuildContext context,
     WidgetRef ref,
   ) async {
+    // Clearing the tunnel cache requires the tunnel to be fully stopped, so
+    // only proceed when the VPN is disconnected. Any other state (connected,
+    // connecting, disconnecting, missingPermission, error) is treated as an
+    // active/in-transition tunnel and is blocked.
     final vpnStatus = ref.read(vpnProvider);
-    if (vpnStatus == VPNStatus.connected) {
+    if (vpnStatus != VPNStatus.disconnected) {
       AppDialog.dialog(
         context: context,
         title: 'turn_off_vpn'.i18n,

lib/lantern/lantern_ffi_service.dart

@@ -1799,7 +1799,12 @@ class LanternFFIService implements LanternCoreService {
   Future<Either<Failure, Unit>> runURLTests() async {
     try {
       final result = await runInBackground<String>(() async {
-        return _ffiService.runURLTests().toDartString();
+        final resultPtr = _ffiService.runURLTests();
+        try {
+          return resultPtr.toDartString();
+        } finally {
+          _ffiService.freeCString(resultPtr);
+        }
       });
       checkAPIError(result);
       return right(unit);
@@ -1813,7 +1818,12 @@ class LanternFFIService implements LanternCoreService {
   Future<Either<Failure, Unit>> sendConfigRequest() async {
     try {
       final result = await runInBackground<String>(() async {
-        return _ffiService.updateConfig().toDartString();
+        final resultPtr = _ffiService.updateConfig();
+        try {
+          return resultPtr.toDartString();
+        } finally {
+          _ffiService.freeCString(resultPtr);
+        }
       });
       checkAPIError(result);
       return right(unit);
@@ -1827,7 +1837,12 @@ class LanternFFIService implements LanternCoreService {
   Future<Either<Failure, Unit>> clearTunnelCache() async {
     try {
       final result = await runInBackground<String>(() async {
-        return _ffiService.clearTunnelCache().toDartString();
+        final resultPtr = _ffiService.clearTunnelCache();
+        try {
+          return resultPtr.toDartString();
+        } finally {
+          _ffiService.freeCString(resultPtr);
+        }
       });
       checkAPIError(result);
       return right(unit);