feat: Auto-cleanup stale Tailscale devices before cluster boot

Adds tailscale-cleanup Ansible role that uses the Tailscale API to
delete offline devices matching reserved hostnames (e.g. rancher).
Runs during site.yml before Finalize to prevent hostname collisions
like rancher-1 on rebuild.

Requires TAILSCALE_API_KEY (API access token) passed as extra var.

ansible/site.yml

@@ -128,6 +128,16 @@
   roles:
     - doppler-bootstrap
 
+- name: Clean up stale Tailscale devices
+  hosts: localhost
+  connection: local
+  vars:
+    tailscale_reserved_hostnames:
+      - rancher
+
+  roles:
+    - tailscale-cleanup
+
 - name: Finalize
   hosts: localhost
   connection: local