v0.14.263

feat(remote): sign a browser in by its tailnet identity (#81)

Devices that reach the web UI through `tailscale serve` on this machine can
skip the host token: the request carries `Tailscale-User-Login`, and when that
login is one the user admitted, the health probe mints the ordinary session
cookie. Everything after that is an unchanged session.

The header is trusted only under conditions checked in `remote/identity.ts`:
web access on; the login on the allowlist (default offer: this node's owner,
read from `tailscale status`); the socket peer loopback, since `tailscaled`
proxies from this machine and any other peer wrote the header itself; and no
`Tailscale-Funnel-Request`. Identity is consulted on `GET /api/remote/health`
and nowhere else, so no mutation path changes and the CSRF analysis holds.

Settings → Remote gains a *Tailscale sign-in* list and, once serving, a one-
click "Sign in automatically as <login>". `WebRoot` re-probes on a 401 before
showing the token form, so an expired session re-mints silently.

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>