refactor(network): remove Tailscale #347

Problem

Once private access runs on wg-access (#346) and callers are identified by their device (#345), Tailscale is only a second network and a second identity system to maintain, document and test.

Proposed solution

Remove Tailscale entirely, rather than keeping it as an option.

• Daemon: the tailnet node and its piqueld-tailscale container, the tailnet listen modes and shared tailscaled, tailnet-bound tokens, the whois lookups, and the tailnet range check on private routes.
• DNS: route DNS records point at the gateway's wg-access address instead of tailnet addresses.
• Configuration: the removed keys fail validation with a message pointing to [access].
• NixOS module: the tailnet options are removed.
• Docs: installation, configuration, ingress, observability and backups (tailnet state).

This is a breaking change for any installation that uses the tailnet. It needs a release note.

Dependencies

• feat(auth): link tailnet users to piqueld accounts #345: device identity.
• feat(ingress): private routes need an environment grant #346: private routes on the access network.

Written with Claude Opus 5.5 in Claude Code (via T3 Code).