feat(tailscale): add connect/disconnect, exit-node and LAN-access controls (#2644)

* feat(tailscale): add connect/disconnect/exit-node/LAN-access backend

The Tailscale backend previously exposed only read-only status
(tailscale.getStatus, tailscale.refresh). This adds write actions through the
existing tailscale.com/client/local integration:

- tailscale.connect / tailscale.disconnect (EditPrefs WantRunning)
- tailscale.setExitNode (EditPrefs ExitNodeID; empty id clears it and any
  legacy ExitNodeIP, mirroring `tailscale set --exit-node`)
- tailscale.setAllowLanAccess (EditPrefs ExitNodeAllowLANAccess)

The manager's client interface gains GetPrefs/EditPrefs; fetchState merges
ExitNodeAllowLANAccess from prefs, and Peer exposes ExitNodeOption so the UI
can list exit-node-capable peers.

* feat(tailscale): expose the new actions in TailscaleService

Adds connectTailscale/disconnectTailscale, setExitNode/clearExitNode and
setAllowLanAccess wrappers, plus derived exitNodeOptions/currentExitNode and the
exitNodeAllowLanAccess state. Write-action errors surface via ToastService.

* feat(tailscale): add connection, exit-node and LAN-access controls to the widget

The control-center widget toggle was a no-op. It now connects/disconnects, and
the detail panel gains a connection status row with a connect/disconnect button,
an exit-node picker and a LAN-access toggle.

core/internal/server/tailscale/handlers.go

@@ -14,6 +14,14 @@ func HandleRequest(conn net.Conn, req models.Request, manager *Manager) {
 		handleGetStatus(conn, req, manager)
 	case "tailscale.refresh":
 		handleRefresh(conn, req, manager)
+	case "tailscale.connect":
+		handleConnect(conn, req, manager)
+	case "tailscale.disconnect":
+		handleDisconnect(conn, req, manager)
+	case "tailscale.setExitNode":
+		handleSetExitNode(conn, req, manager)
+	case "tailscale.setAllowLanAccess":
+		handleSetAllowLanAccess(conn, req, manager)
 	default:
 		models.RespondError(conn, req.ID, fmt.Sprintf("unknown method: %s", req.Method))
 	}
@@ -28,3 +36,37 @@ func handleRefresh(conn net.Conn, req models.Request, manager *Manager) {
 	manager.RefreshState()
 	models.Respond(conn, req.ID, models.SuccessResult{Success: true, Message: "refreshed"})
 }
+
+func handleConnect(conn net.Conn, req models.Request, manager *Manager) {
+	if err := manager.Connect(); err != nil {
+		models.RespondError(conn, req.ID, err.Error())
+		return
+	}
+	models.Respond(conn, req.ID, models.SuccessResult{Success: true, Message: "connected"})
+}
+
+func handleDisconnect(conn net.Conn, req models.Request, manager *Manager) {
+	if err := manager.Disconnect(); err != nil {
+		models.RespondError(conn, req.ID, err.Error())
+		return
+	}
+	models.Respond(conn, req.ID, models.SuccessResult{Success: true, Message: "disconnected"})
+}
+
+func handleSetExitNode(conn net.Conn, req models.Request, manager *Manager) {
+	id := models.GetOr(req, "id", "")
+	if err := manager.SetExitNode(id); err != nil {
+		models.RespondError(conn, req.ID, err.Error())
+		return
+	}
+	models.Respond(conn, req.ID, models.SuccessResult{Success: true, Message: "exit node updated"})
+}
+
+func handleSetAllowLanAccess(conn net.Conn, req models.Request, manager *Manager) {
+	enabled := models.GetOr(req, "enabled", false)
+	if err := manager.SetAllowLANAccess(enabled); err != nil {
+		models.RespondError(conn, req.ID, err.Error())
+		return
+	}
+	models.Respond(conn, req.ID, models.SuccessResult{Success: true, Message: "lan access updated"})
+}