Tailscale sidecar: userspace SOCKS5 and localhost HA proxy (#74)

[NinjaLikesCheez]

Makes the optional Tailscale sidecar on Azure Container Apps actually able to reach Home Assistant. Does not turn it on in live dev (example tfvars stay tailscale_enabled = false). Rollback is still “leave it off” or set it false in gitignored tfvars.

Closes nothing yet — #74 is done in Terraform; flipping the mesh on is an operator apply after Key Vault tailscale-auth-key exists.

What changed

• Sidecar env: TS_USERSPACE, SOCKS5 127.0.0.1:1055, KUBERNETES_SERVICE_HOST="" / TS_KUBE_SECRET="" (ACA containerboot workaround), --advertise-tags=tag:pixel-<env>, no --accept-routes, TS_ACCEPT_DNS=false.
• New ha-proxy container (pinned socat) on the same replica: 127.0.0.1:8123 → SOCKS5 → home_assistant_mesh_host:8123.
• When tailscale_enabled, Pixel’s HOME_ASSISTANT_URL is forced to http://127.0.0.1:8123. Cannot also set home_assistant_url (no Nabu Casa fallback).
• Pixel probes stay /healthz + /readyz on Discord only. No ACA probe on Tailscale.
• One replica (min=max=1). Extra containers, not extra replicas.
• ADR 0011; runbook / architecture / env README. Did not edit docs/infra.md (wait for Thomas).

No application code change — HA still fail-closed in HomeAssistantBackend. No new Node tests.

Operator enable (after merge, not this PR)

Gitignored terraform.tfvars only:

tailscale_enabled        = true
home_assistant_mesh_host = "homeassistant"
# unset home_assistant_url
# Key Vault: tailscale-auth-key + home-assistant-token

Rollback

tailscale_enabled = false, restore home_assistant_url if you still want Nabu Casa, apply. Discord never depended on the sidecar.

Security / auth

Does not touch core/access*, identity, or the HA token rules. Mesh is transport; the non-admin HA token and devices.yaml stay the fence. Tailnet ACL (tcp:8123 only) is still a Tailscale admin step, not Terraform. Dev must not be granted prod doors.