make all four network options work, including having no network at all

Option 1 no longer refuses. It assumes offscale is already running — installing
it is one command, documented on the site — and asks for its address and a key,
which is mechanically what option 2 does. The two share a branch because the
difference between them is what to say, not what to do: one is "you already have
a server", the other is "set one up first, here is where".

Option 4 is new: no private network. Presented as a real choice rather than a
failure to choose, with what it costs stated before it is taken and paged so it
is read rather than scrolled past:

  · anything reachable remotely has to be published deliberately and kept closed
    otherwise
  · TLS certificates are yours to obtain and renew
  · every exposed service needs its own authentication, since there is no longer
    a boundary in front of it
  · the machine will be found — anything on a public address is scanned within
    minutes

And the one that is specific to this platform rather than general advice:
ALLOW_ANY_ORIGIN defaults ON, which is deliberate and only defensible because
the tailnet is the perimeter. With no tailnet it must be set to false with an
HTTPS proxy in front, or Officer runs with a check disabled on an assumption that
is no longer true. The summary line says so, so it survives the run.

Declining option 4 redraws the menu rather than dropping to a bare prompt.
Tailscale is still installed when 4 is chosen, and the run says how to connect it
later.

Verified all four end to end with tailscale stubbed, plus the decline-and-choose-
again path.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/setup/machine-setup/machine-setup.sh

@@ -446,21 +446,25 @@ if ! skip; then
       TS_LOGIN_SERVER=""
       TS_PLANE=""
       while [[ -z "$TS_PLANE" ]]; do
-        if ! read -rp "  Which one? (1/2/3/?): " TS_PLANE_CHOICE; then
+        if ! read -rp "  Which one? (1/2/3/4/?): " TS_PLANE_CHOICE; then
           echo ""
           fail "No answer."
         fi
         case "$TS_PLANE_CHOICE" in
-          1)
-            # TODO(pastilhas): what setting up your own offscale actually does.
-            warn "Setting up your own network is not built yet."
-            echo "     Pick 2 if you already run one, or 3 for tailscale.com."
-            ;;
-          2)
-            # No default offered, deliberately. A coordination server URL is
-            # somebody's private infrastructure, and a machine that joins the
-            # wrong one has joined a stranger's network.
-            read -rp "  URL of your server (e.g. https://headscale.example.com): " TS_LOGIN_SERVER || fail "No answer."
+          1 | 2)
+            # Both end in the same place: a coordination server somebody runs.
+            # The difference is only whether they already have one, which changes
+            # what to say, not what to do.
+            if [[ "$TS_PLANE_CHOICE" == "1" ]]; then
+              echo ""
+              echo "     Install offscale first — one command, per"
+              echo "     https://officer.dev/infrastructure/offscale.html — then give"
+              echo "     this machine its address and a key."
+            fi
+            # No default offered. A coordination server URL is somebody's private
+            # infrastructure, and a machine that joins the wrong one has joined a
+            # stranger's network.
+            read -rp "  Address of your server (e.g. https://headscale.example.com): " TS_LOGIN_SERVER || fail "No answer."
             if [[ "$TS_LOGIN_SERVER" =~ ^https?:// ]]; then
               TS_PLANE="self-hosted"
             else
@@ -468,16 +472,32 @@ if ! skip; then
             fi
             ;;
           3) TS_PLANE="tailscale" ;;
-          "?")
+          4)
             echo ""
-            tailscale_networks_help | page
+            warn "No private network — do this at your own risk."
             echo ""
-            tailscale_network_menu
+            tailscale_none_warning | page
+            echo ""
+            if confirm "Continue with no private network?" n; then
+              TS_PLANE="none"
+            else
+              echo ""
+              tailscale_network_menu
+            fi
             ;;
-          *) warn "Pick 1, 2, 3 or ?." ;;
+          *) warn "Pick 1, 2, 3, 4 or ?." ;;
         esac
       done
 
+      if [[ "$TS_PLANE" == "none" ]]; then
+        warn "no private network — Tailscale is installed but not connected"
+        echo "     Connect it later with:  sudo tailscale up"
+        echo "     Remember ALLOW_ANY_ORIGIN=false and an HTTPS proxy in front of Officer."
+        SUMMARY+=("Tailscale: NOT connected by choice — no private network, ALLOW_ANY_ORIGIN must be set false")
+        TS_CONNECT=false
+      fi
+
+      if [[ "$TS_CONNECT" != false ]]; then
       echo ""
       info "How should this machine authenticate?"
       if [[ "$TS_PLANE" == "tailscale" ]]; then
@@ -587,6 +607,7 @@ if ! skip; then
         ERRORS+=("Tailscale: up did not complete")
         SUMMARY+=("Tailscale: NOT connected")
       fi
+      fi
     fi
   fi
   step_ok