feat: finish the tailscale plugin, including SSH auth (B3)

packages/plugin-sdk/FINISH-LIST.md

@@ -0,0 +1,19 @@
+# Finish list
+
+Running list of things intentionally left unfinished by a Phase B/C step,
+so D0 (or an earlier owner named below) can pick them up. Remove a line once
+it's done.
+
+- **B3 (tailscale):** `ManagerCardShell`/`ManagerSearch`-equivalent presentation
+  is duplicated as `TailscaleManagerShell`/`TailscaleManagerSearch` in
+  `plugins/tailscale/src/frontend/TailscaleManagerShell.tsx` rather than
+  shared with host-metrics's originals. Promote a shared version into
+  `@termix/plugin-sdk/ui` once a second manager-card plugin needs one, per the
+  contract's "add to the SDK when a second plugin needs it" rule. Owner: D1.
+- **B3 (tailscale):** `plugins/tailscale/src/backend/host-metrics-manager.ts`
+  and `routes.ts` still resolve hosts and access through core's
+  `PermissionManager`/`resolveHostById`/`DataCrypto` by relative import
+  instead of a `ctx.hosts`-style SDK API, because `ctx.hosts` is not built yet
+  (status **B** in the ctx surface table). Same debt every other host-metrics
+  manager already carries; not new, but tailscale now carries it too. Owner:
+  whichever step builds `ctx.hosts`.