feat: move tailscale device discovery and settings into a plugin

Adds plugins/tailscale/ with a devices sidebar tab, admin settings
section, and re-auth dialog. Host Metrics tailscale manager card and
SSH re-auth banner parsing stay in core.

plugins/tailscale/backend/index.mjs

@@ -0,0 +1,69 @@
+/**
+ * Tailscale - first-party, in-process plugin.
+ *
+ * This plugin runs on the main thread rather than in a worker for the same
+ * reason fleets and proxmox do (see src/backend/plugins/first-party.ts): it
+ * does not own a live transport of its own (no WebSocket server, no
+ * dedicated port), so it registers its Express router with the
+ * always-mounted /tailscale dispatcher in
+ * src/backend/database/routes/tailscale-dispatch.ts instead of getting its
+ * own port.
+ *
+ * routes.ts is what used to be src/backend/database/routes/tailscale-routes.ts,
+ * moved here and rewritten from a direct app.use() call into
+ * startTailscaleService()/stopTailscaleService(), called from
+ * activate()/deactivate() below.
+ *
+ * tailscale-check.ts (SSH re-auth banner parsing) stays in core, at
+ * src/backend/hosts/tailscale-check.ts, and is NOT part of this plugin.
+ * It is imported directly by src/backend/hosts/terminal/index.ts (owned by
+ * ssh-terminal), which type-checks under tsconfig.node.json's rootDir of
+ * src/ -- a plugin .ts file physically outside that root cannot be a static
+ * import target for core code (see scripts/copy-bundled-plugins.cjs's own
+ * comment: plugin backends import core, never the reverse, anywhere in this
+ * codebase). Moving the file into plugins/tailscale/backend/ would require
+ * either widening tsconfig.node.json's rootDir for every other plugin's
+ * dist path-rewriting, or switching terminal/index.ts to a dynamic import
+ * inside its banner handler -- both bigger changes than this plugin
+ * warrants. The banner/ready wiring and retry state already live in
+ * ssh-terminal's connection handler regardless, so this stays exactly where
+ * that coupling already lives.
+ *
+ * The /users/tailscale-settings GET/PATCH routes stay in core
+ * (src/backend/database/routes/user-settings-routes.ts) -- they are general
+ * user-settings infrastructure, not Tailscale-specific plumbing, and this
+ * plugin's frontend calls them the same way core code does.
+ */
+
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+/**
+ * Loads a module by its path relative to this file's own directory.
+ *
+ * The plugin ships beside dist/backend, so in a built server the compiled
+ * .js for routes.js sits right next to this .mjs. Under vitest/dev nothing
+ * imports this plugin directly (the loader loads in-process plugins with a
+ * plain dynamic import, no tsx loader involved), so the only layout that
+ * needs to resolve here is the built one.
+ */
+async function loadRelative(relativePath) {
+  const here = path.dirname(fileURLToPath(import.meta.url));
+  const target = path.join(here, `${relativePath}.js`);
+  return import(new URL(`file://${target.replace(/\\/g, "/")}`).href);
+}
+
+let routesModule = null;
+
+export async function activate(ctx) {
+  routesModule = await loadRelative("routes");
+  routesModule.startTailscaleService();
+  ctx.log.info("Tailscale router registered at /tailscale");
+}
+
+export async function deactivate() {
+  if (routesModule) {
+    routesModule.stopTailscaleService();
+    routesModule = null;
+  }
+}

plugins/tailscale/backend/routes.ts

@@ -0,0 +1,142 @@
+// Was src/backend/database/routes/tailscale-routes.ts, moved here and
+// rewritten to register itself via the shared /tailscale dispatcher
+// (src/backend/database/routes/tailscale-dispatch.ts) instead of taking a
+// direct reference to the app instance, the same way fleets does.
+
+import { Router } from "express";
+import { AuthManager } from "../../../src/backend/utils/auth-manager.js";
+import { apiLogger } from "../../../src/backend/utils/logger.js";
+import { fetchWithProxy } from "../../../src/backend/utils/proxy-agent.js";
+import { createCurrentSettingsRepository } from "../../../src/backend/database/repositories/factory.js";
+import {
+  registerTailscaleRouter,
+  unregisterTailscaleRouter,
+} from "../../../src/backend/database/routes/tailscale-dispatch.js";
+
+interface TailscaleDevice {
+  id: string;
+  name: string;
+  hostname: string;
+  addresses: string[];
+  os: string;
+  lastSeen: string;
+}
+
+interface TailscaleAPIDevice {
+  id: string;
+  name: string;
+  hostname: string;
+  addresses: string[];
+  os: string;
+  lastSeen: string;
+  nodeId?: string;
+}
+
+const DEFAULT_TAILSCALE_API_BASE = "https://api.tailscale.com/api/v2";
+
+export const router = Router();
+
+const authManager = AuthManager.getInstance();
+const authenticateJWT = authManager.createAuthMiddleware();
+
+function normalizeApiBase(raw: string | null): string {
+  const trimmed = (raw ?? "").trim().replace(/\/+$/, "");
+  return trimmed || DEFAULT_TAILSCALE_API_BASE;
+}
+
+/**
+ * @openapi
+ * /tailscale/devices:
+ *   get:
+ *     summary: List Tailscale devices
+ *     description: Returns the list of devices in the configured tailnet using the stored API key.
+ *     tags:
+ *       - Tailscale
+ *     responses:
+ *       200:
+ *         description: List of tailnet devices.
+ *         content:
+ *           application/json:
+ *             schema:
+ *               type: object
+ *               properties:
+ *                 devices:
+ *                   type: array
+ *                   items:
+ *                     type: object
+ *       500:
+ *         description: Failed to fetch Tailscale devices.
+ */
+router.get("/devices", authenticateJWT, async (_req, res) => {
+  try {
+    const settingsRepo = createCurrentSettingsRepository();
+    const apiKey = (await settingsRepo.get("tailscale_api_key")) ?? "";
+    if (!apiKey) {
+      return res.json({ devices: [], hasApiKey: false });
+    }
+    const apiBase = normalizeApiBase(
+      await settingsRepo.get("tailscale_api_base_url"),
+    );
+
+    const url = `${apiBase}/tailnet/-/devices?fields=all`;
+    const response = await fetchWithProxy(url, {
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        "User-Agent": "Termix/1.0",
+      },
+    });
+
+    if (!response.ok) {
+      apiLogger.warn("Tailscale API returned non-OK status", {
+        operation: "tailscale_devices",
+        status: response.status,
+      });
+      if (response.status === 401 || response.status === 403) {
+        return res.status(401).json({
+          error: "Invalid Tailscale API key",
+          devices: [],
+          hasApiKey: true,
+        });
+      }
+      return res.status(502).json({
+        error: "Tailscale API error",
+        devices: [],
+        hasApiKey: true,
+      });
+    }
+
+    const data = (await response.json()) as { devices: TailscaleAPIDevice[] };
+
+    const devices: TailscaleDevice[] = (data.devices ?? []).map((d) => ({
+      id: d.id,
+      name: d.name,
+      hostname: d.hostname,
+      addresses: d.addresses ?? [],
+      os: d.os,
+      lastSeen: d.lastSeen,
+    }));
+
+    res.json({ devices, hasApiKey: true });
+  } catch (err) {
+    apiLogger.error("Failed to fetch Tailscale devices", err, {
+      operation: "tailscale_devices",
+    });
+    res.status(500).json({
+      error: "Failed to fetch Tailscale devices",
+      devices: [],
+      hasApiKey: true,
+    });
+  }
+});
+
+/** Called from activate(). Mounts this router at /tailscale via the shared
+ * dispatcher. */
+export function startTailscaleService(): void {
+  registerTailscaleRouter(router);
+}
+
+/** Called from deactivate(). /tailscale/* falls back to 404 until
+ * reactivated. */
+export function stopTailscaleService(): void {
+  unregisterTailscaleRouter();
+}