offscale, extracted from the platform into its own repository

The tailnet plugin — machines, users, pre-auth keys, access policy and device
invites. Moved out of officerdev/platform, where it had lived in plugins/ since
the plugin system was built.

Until now this code existed in exactly one place: the platform repository. That
made "gitignore the plugins directory" impossible to do safely, because
untracking it would have left 49 files on a single disk with no remote. This
repository is what makes that move safe.

Same extraction as plugins/music before it: source only, no history. The
platform's history still holds every commit that shaped this, and the SHAs cited
across the codebase keep resolving — replaying it here would have created a
second, divergent account of the same work.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

sidecar/active.ts

@@ -0,0 +1,20 @@
+import { getActiveHeadscaleCredentials } from '../db/queries';
+import { createClient, type HeadscaleClient } from './client';
+
+// Every domain route acts on the ACTIVE server — the one the owner selected in the servers section. That
+// choice lives in Postgres (one row, enforced by a partial unique index), not in a request parameter, so
+// no client can act on a server the owner isn't currently looking at by guessing an id.
+
+/**
+ * The client for the active server, or a ready-to-send 409 when there isn't one.
+ *
+ * 409 rather than 404: the route exists and the request was well-formed, the account just has no server
+ * selected yet. The UI maps it to "pick a server", which is a different message from "that node is gone".
+ */
+export async function activeClient(userId: number): Promise<HeadscaleClient | Response> {
+  const creds = await getActiveHeadscaleCredentials(userId);
+  if (!creds) {
+    return Response.json({ error: 'no active Headscale server', code: 'no_active_server' }, { status: 409 });
+  }
+  return createClient(creds);
+}