DC-149: WireGuard hub provider (peer store, pool allocator, hub lifecycle) + tests

dashcaddy-api/src/network/providers/tailscale.js

@@ -259,14 +259,17 @@ function createTailscaleProvider({
     },
 
     /**
-     * Unblock is a no-op at the Tailscale level: key expiry is reversed by
-     * the user re-authenticating, and access restoration happens when
-     * DashCaddy re-syncs the ACL (syncAccess). Kept in the contract so the
-     * orchestration layer (DC-143) can call it uniformly across providers.
+     * Unblock is honest, not fully reversible (corrected spec): key expiry
+     * cannot be undone — there is no Tailscale API to un-expire a device
+     * key. This method re-allows the person at the ACL level only (the ACL
+     * compiler re-push on unblock drops the network deny); the user must
+     * RE-AUTHENTICATE each device for it to rejoin the tailnet. Kept in the
+     * contract so the orchestration layer (DC-143) can call it uniformly.
+     * @returns {{ restored: boolean, reauthRequired: boolean }}
      */
     async unblockPerson() {
       await Promise.resolve(); // uniform async surface (contract: all async)
-      return { restored: true };
+      return { restored: true, reauthRequired: true };
     },
 
     /**