refactor: move tailscale join fully into cloud-init

Remove guest-agent enrollment workflow, pass TS auth key through Terraform variables/secrets, and run tailscale up with tag:k8s during cloud-init bootstrap alongside SSH key injection.

terraform/variables.tf

@@ -71,3 +71,9 @@ variable "SSH_KEY_PUBLIC" {
   type        = string
   description = "Public SSH key injected via cloud-init"
 }
+
+variable "TS_AUTHKEY" {
+  type        = string
+  sensitive   = true
+  description = "Tailscale auth key used during cloud-init enrollment"
+}