Native Tailscale access to deployments

Convex already runs the deployment runtime, so embedding Tailscale via tsnet (now natively integrated with Tailscale Services) would let each deployment join a tailnet as its own node with its own IP, DNS name, certs, and ACL tags. Auth via a one-time auth key or OAuth client pasted into deployment settings. For outbound, the same node dials private resources exposes to the tailnet (like a database reachable over Tailscale) so nothing needs public ingress.