P7 r2 fixes: drift guard wired through pushIfNoDrift (acl_drift_detected ProviderError, never overwrites drifted remote) + unknown-device forward_auth audit + drift regression tests

dashcaddy-api/src/network/providers/tailscale.js

@@ -417,6 +417,16 @@ function createTailscaleProvider({
       try {
         pushed = await engine.push(compiled.policy);
       } catch (err) {
+        if (err && err.code === 'acl_drift_detected') {
+          // Drift guard (spec hard rule): the remote policy hash no longer
+          // matches our last-known-good — someone edited ACLs outside
+          // DashCaddy. NEVER silently overwrite. Surface as a distinct,
+          // non-retryable ProviderError carrying the drift details.
+          throw new ProviderError(
+            'tailscale: remote ACL policy drifted from DashCaddy last-known-good — refusing to overwrite; review the tailnet ACL console and re-import or force-sync',
+            { code: 'acl_drift_detected', retryable: false, cause: err, drift: err.drift }
+          );
+        }
         if (err instanceof AclPushError) {
           // API-side failure: map the pusher's code through the shared
           // vocabulary (acl_rejected → bad_input, rate-limited/http_* →