v1.2.0

Added

• Visual ACL policy editor. Access controls now has four tabs: Rules
  (who can reach what, with source/destination/port/protocol forms),
  Groups & tags (reusable groups and tag owners), Test access (a
  simulator: pick a source and a destination and it says whether the policy
  allows it and which rule matched — not a live packet test), and Advanced
  (HuJSON), the original text editor kept as a full fallback. Under the
  hood, visual edits rewrite only the acls, groups or tagOwners block
  they touch and leave the rest of the file — comments, key order, hand-written
  ssh or autoApprovers sections — untouched. Verified against a live
  Headscale instance: real device connectivity (per-user isolation and a
  tag-based rule) matched the simulator's predictions in every case tested.
• Optional public DERP servers. The installer now asks whether to also use
  Tailscale's public DERP relays (default: yes); answering no gives a fully
  self-hosted install with only the embedded relay (DERP_USE_PUBLIC in
  .env). uninstall.sh gains a --lang en|es option.