When refresh_status() detects a dead VM process, it now tears down
network interfaces and cleans up storage resources before marking the
VM as stopped. This prevents TAP devices and iptables rules from
leaking when a VM process crashes.

@@ -124,0 +158,4 @@
+
+    let cleaned = running_before.len() - running_after.len();
+    if cleaned > 0 {
+        println!("Cleaned up {} crashed VM(s)", cleaned);

@@ -124,0 +169,4 @@
+        .map(|id| id[..std::cmp::min(8, id.len())].to_string())
+        .collect();
+
+    // Collect IPs of running VMs for iptables orphan detection

@@ -124,0 +273,4 @@
+            Ok(out) if out.status.success() => removed += 1,
+            _ => {}
+        }
+    }