offscale, extracted from the platform into its own repository

The tailnet plugin — machines, users, pre-auth keys, access policy and device
invites. Moved out of officerdev/platform, where it had lived in plugins/ since
the plugin system was built.

Until now this code existed in exactly one place: the platform repository. That
made "gitignore the plugins directory" impossible to do safely, because
untracking it would have left 49 files on a single disk with no remote. This
repository is what makes that move safe.

Same extraction as plugins/music before it: source only, no history. The
platform's history still holds every commit that shaped this, and the SHAs cited
across the codebase keep resolving — replaying it here would have created a
second, divergent account of the same work.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

api/router.ts

@@ -0,0 +1,18 @@
+import { createSidecarProxy } from '@@/sidecar/create-proxy';
+
+// /api/headscale/* — auth, then forward to officer-headscale. No routes of its own and no headscale knowledge:
+// this file must never grow app logic.
+//
+// The sidecar exposes only Officer-owned routes under `/_officer/` — Headscale's REST shape differs
+// across releases, and version handling belongs in the sidecar. It holds the admin API key; the platform
+// does not know Headscale's URL.
+
+const proxy = createSidecarProxy({
+  name: 'headscale',
+  prefix: '/api/offscale',
+});
+
+export const router = proxy.router;
+
+/** Base URL of the sidecar's HTTP server, or null if it hasn't reported in yet. */
+export const getHeadscaleServerUrl = proxy.getHttpUrl;