fix(tailscale): bundle Docker binaries and support host socket

[mahdiwafy]

Summary

• Bundles tailscale and tailscaled into the Docker image.
• Adds environment configuration for using the bundled daemon or a host Tailscale socket.
• Updates docker compose/env examples for the Tailscale Docker flow.

Scope

Focused only on Tailscale-in-Docker runtime support.

Verification

• npm run lint:undef

[Vanszs]

Request for revision with concrete deployment requirements.

The Docker Tailscale support is relevant, but please separate bundled binaries from host-socket mode.

Please add:

• pinned version plus checksum/signature verification for downloaded binaries;
• tested architecture coverage for amd64 and arm64;
• a test or documented guarantee that host-socket mode never starts, stops, or kills the host daemon;
• explicit non-root execution/permissions coverage;
• a minimal capability policy, with CAP_NET_ADMIN enabled only when required;
• compose documentation showing the socket mount and its security implications.

The application must retain its existing local-daemon fallback and tunnel lifecycle. Please keep Docker privilege changes out of the runtime logic unless required by the selected mode.

[mahdiwafy]

Superseded by focused #88 (tailscale) / #90 (api-key limits).