refactor: move tailscale join fully into cloud-init

Remove guest-agent enrollment workflow, pass TS auth key through Terraform variables/secrets, and run tailscale up with tag:k8s during cloud-init bootstrap alongside SSH key injection.

.gitea/workflows/terraform-plan.yml

@@ -26,6 +26,7 @@ jobs:
           cat > secrets.auto.tfvars << EOF
           pm_api_token_secret = "${{ secrets.PM_API_TOKEN_SECRET }}"
           SSH_KEY_PUBLIC      = "$(printf '%s' "${{ secrets.SSH_KEY_PUBLIC }}" | tr -d '\r\n')"
+          TS_AUTHKEY          = "$(printf '%s' "${{ secrets.TS_AUTHKEY }}" | tr -d '\r\n')"
           EOF
           cat > backend.hcl << EOF
           bucket                      = "${{ secrets.B2_TF_BUCKET }}"