DC-043: tailscale coordination API client + admin/settings routes

Companion to DC-042 (tailscale-manager). Adds the write-side of Tailscale
integration — REST client for api.tailscale.com that lets DashCaddy
manage its own tailnet (devices, pre-auth keys, users, ACL).

src/managers/tailscale-coord.js — new module:
  * Ping, list/get/delete devices, create/list/delete pre-auth keys,
    list users, get/update ACL
  * 5min read cache, 60s device-list cache, 1hr ping cache
  * Cache invalidation on writes
  * Graceful {configured:false} when no token
  * TailscaleCoordError class with code mapping (unauthorized, not_found,
    rate_limited, server_error)
  * fetchImpl injection point for tests; native https in production
  * 45 unit tests covering all paths

src/context/index.js — new tailscaleCoord namespace:
  * getClient() lazy-builds a fresh client each call (token re-read from
    credentialManager so settings changes take effect without restart)
  * loadMetadata/saveMetadata for tailscale-config.json
  * setApiToken/hasApiToken wrappers around credentialManager

routes/tailscale-admin.js — new routes:
  * GET    /api/v1/tailscale/settings         — config status, never the token
  * PUT    /api/v1/tailscale/settings         — validate + store encrypted
  * DELETE /api/v1/tailscale/settings         — wipe token + metadata
  * POST   /api/v1/tailscale/settings/test    — ping without saving
  * GET    /api/v1/tailscale/admin/devices    — full device list
  * DELETE /api/v1/tailscale/admin/devices/:id — revoke device
  * GET    /api/v1/tailscale/admin/users      — tailnet users
  * GET    /api/v1/tailscale/admin/keys       — pre-auth key metadata
  * POST   /api/v1/tailscale/admin/keys       — create pre-auth key (returns secret ONCE)
  * DELETE /api/v1/tailscale/admin/keys/:id   — revoke pre-auth key
  * 29 route integration tests with supertest

src/app.js — wired the new router into the /api/v1/tailscale mount.

BACKLOG.md — DC-042 marked done, DC-043 added with full design notes.
            Note: deliberately no token auto-rotation — Tailscale API keys
            don't auto-renew, and silently re-issuing admin credentials
            would erode the audit-trail checkpoint that token expiry
            provides.

Tests: 1167 -> 1212 (+45), all green. Lint clean.

dashcaddy-api/src/app.js

@@ -64,6 +64,7 @@ const notificationRoutes = require('../routes/notifications');
 const containerRoutes = require('../routes/containers');
 const serviceRoutes = require('../routes/services');
 const tailscaleRoutes = require('../routes/tailscale');
+const tailscaleAdminRoutes = require('../routes/tailscale-admin');
 const sitesRoutes = require('../routes/sites');
 const credentialsRoutes = require('../routes/credentials');
 const arrRoutes = require('../routes/arr');
@@ -537,6 +538,13 @@ async function createApp() {
     SERVICES_FILE: ctx.SERVICES_FILE,
     log: ctx.log
   }));
+  apiRouter.use('/tailscale', tailscaleAdminRoutes({
+    tailscaleCoord: ctx.tailscaleCoord,
+    asyncHandler: ctx.asyncHandler,
+    ok: ctx.ok,
+    log: ctx.log,
+    logError: ctx.logError,
+  }));
   apiRouter.use(sitesRoutes({
     asyncHandler: ctx.asyncHandler,
     ok: ctx.ok,