refactor: move tailscale join fully into cloud-init

Remove guest-agent enrollment workflow, pass TS auth key through Terraform variables/secrets, and run tailscale up with tag:k8s during cloud-init bootstrap alongside SSH key injection.

terraform/files/cloud_init_global.tpl

@@ -1,5 +1,4 @@
 #cloud-config
-hostname: ${hostname}
 manage_etc_hosts: true
 resolv_conf:
   nameservers:
@@ -7,9 +6,12 @@ resolv_conf:
     - 1.1.1.1
 
 preserve_hostname: false
-fqdn: ${hostname}.${domain}
 
 users:
   - name: micqdf
     ssh_authorized_keys:
       - ${SSH_KEY_PUBLIC}
+
+runcmd:
+  - [ /run/current-system/sw/bin/sh, -lc, "install -d -m 700 /var/lib/tailscale && rm -f /var/lib/tailscale/tailscaled.state" ]
+  - [ /run/current-system/sw/bin/sh, -lc, "/run/current-system/sw/bin/tailscale up --reset --auth-key='${TS_AUTHKEY}' --hostname='$(hostname)' --advertise-tags='tag:k8s'" ]