add POST /api/vpn/enroll for OffTail

The in-app Tailscale needs one thing from the platform: a way to turn an authenticated
Officer session into a Headscale pre-auth key, so the phone registers itself instead of
someone pasting a key by hand. The VPN's control and data planes talk directly to
Headscale — never through /api — so this is not a proxy and should not become one.

Headscale itself runs on a separate host, managed manually. The platform consumes
HEADSCALE_URL (also returned as controlUrl) and HEADSCALE_API_KEY, both from the host
env. Neither is set yet, which is why an unconfigured instance answers 503 rather than
crashing — Headscale is being stood up in parallel.

The response is `{ controlUrl, authKey }` exactly, because enrollVpn() in
@officer/core/officer-net.ts reads those two fields; changing the shape means changing the
app.

Two things the spec's sketch does not do:

- The `user` field changed meaning across Headscale versions — a name on <=v0.22, a
  numeric id on v0.23+ — and we cannot see which one is running from here. So it resolves
  the id via /api/v1/user and tries that first, falling back to the name. Whichever the
  live server accepts wins, and neither version needs a config flag.
- Upstream calls carry a 10s timeout, and upstream error bodies are logged but never
  returned to the client: that is an admin API and its errors are descriptive.

The standalone app's origin follows the platform's own convention rather than the spec's
literal: every other app origin is an env var with a scope rule, so this one is
OFFICER_TAIL_ORIGIN (set in .env on this host), restricted to /api/auth + /api/vpn the way
OffVault is restricted to /api/auth + /api/vault. The OffTail tile embedded in the main
Officer app needs nothing — it reuses OFFICER_APP_ORIGIN.

Not implemented: the optional GET/DELETE /api/vpn/devices. They are not needed for a first
connection and are better written against a running Headscale.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/servers/_middlewares/origin-validation.ts

@@ -4,7 +4,8 @@ import { IS_DEV_BUILD } from '../build-env';
 import { verify } from '../jwt';
 import { isSuperAdmin } from '../super-admin';
 
-const { PUBLIC_URL, OFFICER_APP_ORIGIN, MUSIC_APP_ORIGIN, OFFICER_VAULT_ORIGIN } = process.env;
+const { PUBLIC_URL, OFFICER_APP_ORIGIN, MUSIC_APP_ORIGIN, OFFICER_VAULT_ORIGIN, OFFICER_TAIL_ORIGIN } =
+  process.env;
 
 // The allowed production web origin comes from PUBLIC_URL in .env (e.g. https://officer.pastilhas.dev),
 // not a hardcoded domain.
@@ -37,6 +38,10 @@ const APP_ORIGINS: string[] = [
   // the platform AND reach the Vaultwarden reverse-proxy; ORIGIN_RULES below restricts it to
   // /api/auth + /api/vault. Vault access uses its own Bitwarden bearer token (not a platform account).
   OFFICER_VAULT_ORIGIN,
+  // Standalone OffTail app (the in-app Tailscale) — its own custom-scheme origin. It signs in and enrolls
+  // with Headscale; ORIGIN_RULES below restricts it to /api/auth + /api/vpn. The OffTail tile embedded in
+  // the main Officer app needs nothing here — it reuses OFFICER_APP_ORIGIN.
+  OFFICER_TAIL_ORIGIN,
 ].filter((o): o is string => Boolean(o));
 
 // The only path prefixes a non-owner account (and the music app) may reach.
@@ -62,6 +67,9 @@ if (MUSIC_APP_ORIGIN) ORIGIN_RULES[MUSIC_APP_ORIGIN] = { paths: NON_OWNER_PATHS
 // else. No superAdminOnly: the owner signs in here, and vault calls carry Bitwarden tokens (not platform
 // accounts), so the account backstop never applies to them (verify() → null → passes).
 if (OFFICER_VAULT_ORIGIN) ORIGIN_RULES[OFFICER_VAULT_ORIGIN] = { paths: ['/api/auth', '/api/vault'] };
+// OffTail signs in (/api/auth) and mints its Headscale pre-auth key (/api/vpn) — nothing else. The VPN
+// itself never comes through /api, so this pair is the app's entire platform surface.
+if (OFFICER_TAIL_ORIGIN) ORIGIN_RULES[OFFICER_TAIL_ORIGIN] = { paths: ['/api/auth', '/api/vpn'] };
 
 // True when an Origin is reserved for the platform owner (used at signin to reject a non-owner login).
 export function isSuperAdminOnlyOrigin(origin: string | undefined): boolean {