selfhost(docker): Tailscale sidecar — tailnet-native access without exposed ports

[JSONbored]

Part of #980. Part of #1199.

Add a Tailscale sidecar to the compose stack so operators can access the self-hosted instance over their tailnet without exposing any public ports.

Scope:

• ghcr.io/tailscale/tailscale:stable in the tailscale compose profile
• network_mode: host so the sidecar can advertise the host on the tailnet
• TS_AUTHKEY, TS_STATE_DIR, TS_EXTRA_ARGS env vars; auth key loaded from Tailscale admin console
• tailscale-state named volume for persistent node identity across restarts
• Once active, the app is reachable at http://<tailnet-hostname>:8787 with no firewall holes