the platform stops explaining what Headscale is

Correcting my own reasoning from the last commit. I left "Headscale's API", "the
Headscale admin credential" and similar alone on the grounds that they name the
thing the plugin drives, so renaming them would make the sentences false. True as
far as it goes, and it misses the point: those sentences are in the PLATFORM. It
has no business knowing what Headscale is at all. Correct language in the wrong
repository is still a remnant.

Ten of them, each replaced with the platform's own vocabulary rather than the
plugin's domain:

- `crypto.ts` and `secret-store.ts` listed "the Headscale admin credential" among
  what one key used to protect. It is "the tailnet's admin credential" — the
  purpose, which is a word this repository owns.
- `catalogue.ts` and `availability.ts` explained `alsoServes` — a LIVE mechanism —
  entirely through a Headscale example that left the repository. Restated as the
  general shape, with one parenthesis saying which case produced it.
- The photos types file explained another plugin's sidecar.
- `App.tsx` cited `/headscale/:section` as the example of a route pair; that route
  does not exist. `/photos/:section` does.
- `plugins/router.ts` pointed at `useCompanionLogStream`, a hook that lives in a
  plugin now.
- `registry.ts` said in the present tense that `headscale` is `admin` — the
  permission is the plugin's and it declares its own, so a member-facing enrolment
  surface would be the PLUGIN's to add, not this file's.
- `proxy.sh` cited `headscale/schema.ts` as a style reference. That file is not in
  this repository.
- machine-setup said "Its Headscale app" — the app is the Offscale plugin.

`machine-setup/lib/tailscale.sh` keeps all ten of its mentions: it exists to
explain tailscale, headscale and offscale to somebody choosing between them, on a
core install, before any plugin exists. That is machine setup's subject, not the
plugin's domain leaking upward.

What survives elsewhere is only dated history — "was here until 2026-08-15", "It
was: music, vault, slskd, headscale, …" — plus the notes about the real
`headscale_servers` orphan and the secret-store key removed yesterday. Those record
that something called headscale used to be here, which is a different claim from
explaining what it does.

tsgo clean, frontend builds, 873 pass / 7 fail unchanged, setup scripts parse.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/setup/machine-setup/lib/tailscale.sh

@@ -165,7 +165,7 @@ tailscale_networks_help() {
   echo "     before anything that can lock you out, so there is always a second"
   echo "     way in."
   echo ""
-  echo "     Officer also administers it. Its Headscale app talks to headscale"
+  echo "     Officer also administers it. Its Offscale plugin talks to headscale"
   echo "     and offscale servers alike: register as many as you run, see which"
   echo "     are actually up — each is probed, not remembered — and switch"
   echo "     between them. On whichever is active you get the nodes, the users,"

scripts/setup/officer-setup/lib/proxy.sh

@@ -327,7 +327,7 @@ proxy_claim_admin() {
   # Deliberately NOT written to a file. The platform's shape is that
   # secrets/officer-keys.db holds ENCRYPTION KEYS, one per purpose, and the credential
   # itself lives encrypted in Postgres. A third plaintext location is the pattern
-  # headscale/schema.ts calls "debt to avoid copying, not a precedent to follow".
+  # the platform elsewhere calls "debt to avoid copying, not a precedent to follow".
   #
   # Nothing programmatic needs this after setup — only a human logging into the admin
   # UI — so not storing it is a legitimate outcome rather than a gap.