optional Tailscale + nginx sidecars for tailnet exposure (auto-gen from terminals.json, headscale-compat)
