there is no automated cleanup of server resources when tunnels expire. the gc (garbage collection) command exists in fab already; we just need to implement some stuff in opentofu to kick it off as a task once a week, along with proper permissions to remove resources.