fix: harden Tailscale operator rollout with preflight and diagnostics

ansible/roles/observability/tasks/main.yml

@@ -208,7 +208,9 @@
           - Tailnet FQDN: http://grafana.{{ tailscale_tailnet | default('tailnet.ts.net') }}
           
           Note: Ensure Tailscale Kubernetes Operator is installed first
-  when: tailscale_oauth_client_id is defined and tailscale_oauth_client_id | length > 0
+  when:
+    - tailscale_oauth_client_id | default('') | length > 0
+    - tailscale_oauth_client_secret | default('') | length > 0
 
 - name: Show observability access details (fallback)
   debug:
@@ -223,4 +225,5 @@
       {% else %}
       Loki: Disabled
       {% endif %}
-  when: tailscale_oauth_client_id is not defined or tailscale_oauth_client_id | length == 0
+  when:
+    - tailscale_oauth_client_id | default('') | length == 0 or tailscale_oauth_client_secret | default('') | length == 0