Expose private apps using Tailscale Services

[macecchi]

Disclaimer: feel free to reject if you don't think this needs to be in this project - it might be specific to my needs, but could be a cool addition since we already use Tailscale on the server setup :)

Allows apps to be added with --tunnel private to be served only to your tailnet, with no public DNS or Cloudflare in the path.

Each private app becomes a Tailscale Service (svc:<name>, tagged tag:singleserver). The service is created through the Tailscale API using a stored OAuth client, and tailscale serve --service terminates HTTPS on the node and hands requests to Kamal.

Changes:

• tunnel: public|private modeled as app config, fixed at add time; private apps default to https://<name>.<tailnet>.ts.net or take one --domain
• connect tailscale accepts --oauth-client-id/--oauth-client-secret (validated against the API before storing); interactive add/connect walk through the one-time tailnet setup
• list, status, and doctor are tunnel-aware: private apps show their qualified domain and deployed commit, and skip Cloudflare checks
• Safety: service creation refuses to adopt a same-name service not created by Single Server, rolls back on failed provisioning, and surfaces tailscale serve shutdown failures instead of leaving a service serving
• Docs updated (home page + docs site)

Testing: I've been using this on my own server, finally got the time to tidy it up for the PR