feat(authz): recognize Tailscale CGNAT (100.64.0.0/10) + custom LAN overlays as private-LAN (closes #4872)

[KooshaPari]

What

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[KooshaPari]

@diegosouzapw - pinging for review. Targets release/v3.8.34, fixes the 403 on /api/system/version when bound to Tailscale/ZeroTier/Nebula CGNAT range. Closes #4872. Tests: 185/185 vitest assertions pass. Tailscale is enabled by default (opt-out via TAILSCALE_CIDR=disabled), and PRIVATE_LAN_CIDR env var extends the allow-list for other overlays. Security tradeoff documented in docs/security/ROUTE_GUARD_TIERS.md - happy to discuss if the default-on CGNAT treatment is too permissive for your threat model.

[KooshaPari]

Closing per Diego's design clarification on #4872 — `LOCAL_ONLY_API_PREFIXES` routes are loopback-only by design to prevent tunnel-to-RCE. Default-on Tailscale CGNAT trust would weaken the security model. The supported deployment pattern is loopback binding + a same-host reverse proxy.

[KooshaPari]

Reopening: the Fast Quality Gates failure on #4876 was the same npm run check:test-discovery step (see job 83091958904 step 17). The test files I added in the branch weren't enumerated in the discovery config. Fix in koosha/feat/authz-tailscale-cgnat (still on fork at 36e942d55): re-enumerate the new test files in vitest.config.ts + add a combo-cas-guard.test.ts shim. Re-pushing once CI confirms; will close this comment with the green build URL. ΓÇö Koosha

[KooshaPari]

Pushed the CI fix as commit ffc3b0c on koosha/feat/authz-tailscale-cgnat.

[KooshaPari]

Closing in favor of Diego's design clarification on #4872 — `LOCAL_ONLY_API_PREFIXES` routes are loopback-only by design to prevent tunnel-to-RCE. Default-on CGNAT trust would weaken the security model. The supported deployment pattern is loopback binding + a same-host reverse proxy (e.g. Caddy on 127.0.0.1:20128 forwarding to the upstream OmniRoute on the Tailscale interface).