rebrand to OffScale, and fix what the first extraction missed

Offscale was the first plugin extracted and it was done before we knew what
"extracted" meant. Music, done last, is the standard. This brings offscale to it.

── The rebrand ──

The plugin was `offscale` to the platform and `headscale` to itself: sidecar
name and handles, the port announcement, the API proxy name, the React
components, every hook, the react-query keys, the panel ids and appTypes, and
the Postgres table. Now all of those say offscale.

The line drawn, and it is deliberate: OffScale is Officer's tooling layer, and
Headscale is the server it manages. So every IDENTIFIER is offscale, while a
message like `headscale unreachable`, the `headscale apikeys create` hint and the
ACL assistant's prompt still say Headscale — because they are talking about the
remote server, and renaming them would make the code lie about what it reached.
495 occurrences became 180, and the 180 are all of that second kind.

── The live bug this uncovered ──

`headscaleSectionPath` built links to `/headscale/<section>`. The shell has no
such route — plugin routes come from `plugin.route`, which is `/offscale` — and
it redirects unknown paths to the home page. So every section link in the nav,
the console and the server picker silently went home. The extraction moved the
route and left the link builder behind.

Also live: ServersView told the user to run
`pm2 start ecosystem.config.cjs --only officer-headscale`, a process that has not
existed since the sidecar was renamed.

── The correctness fix music already had ──

api/router.ts hardcoded `prefix: '/api/offscale'`. The proxy strips
`prefix.length` characters, so a literal is correct only for a first-party
publisher; published by anyone else this mounts at `/api/p/<publisher>/offscale`
and forwards the wrong subpath. Derived from `mountPrefix()` now, as music does.

── The rest ──

- assets/icon.png — the OffScale artwork, 256px to match music's. The tile stops
  being a glyph badge.
- First tests: 21 of them, over the version floor and the protobuf normalisers.
  Those are the two places a Headscale release actually breaks this, and they had
  no coverage at all. `meetsFloor` has a real trap pinned now — comparing minor
  first would refuse 1.0 as older than 0.29.
- OFFSCALE_API.md — the contract was a 45-line comment inside sidecar/index.ts,
  which is not linkable and not published. Now a document, as MUSIC_API.md is.
- web/panels.ts re-exported three components. A plugin cannot export components;
  that was residue of the platform importing them before extraction.
- Comments pointed at src/servers/api/headscale/ and src/servers/sidecar/headscale/,
  neither of which has existed since the extraction.

The crypto purpose moved headscale → offscale too, and the secret-store row was
renamed rather than left to create a fresh key — the material is preserved, so
this is reversible. Free to do only because offscale_servers had 0 rows; with one
stored API key it would have been a migration.

sidecar/servers.ts

@@ -1,14 +1,14 @@
 import type { OfficerContext } from './routes';
 import {
-  listHeadscaleServers,
-  createHeadscaleServer,
-  updateHeadscaleServer,
-  setActiveHeadscaleServer,
-  deleteHeadscaleServer,
-  getHeadscaleCredentials,
-  recordHeadscaleProbe,
+  listOffscaleServers,
+  createOffscaleServer,
+  updateOffscaleServer,
+  setActiveOffscaleServer,
+  deleteOffscaleServer,
+  getOffscaleCredentials,
+  recordOffscaleProbe,
 } from '../db/queries';
-import { createClient, HeadscaleError } from './client';
+import { createClient, OffscaleError } from './client';
 import { probeVersion, MIN_VERSION_LABEL } from './version';
 import { badRequest, notFound, methodNotAllowed } from './routes';
 import { normalizeSshHost } from './ssh';
@@ -56,12 +56,12 @@ async function validateServer(url: string, apiKey: string): Promise<string | Res
   }
 
   // Cheapest authenticated GET whose path is stable across releases, and the same call Headscale's own
-  // clients use to test a key. A wrong key surfaces here as HeadscaleError(502, 'rejected the stored key').
+  // clients use to test a key. A wrong key surfaces here as OffscaleError(502, 'rejected the stored key').
   const client = createClient({ id: 0, name: 'probe', url, apiKey });
   try {
     await client.call('/api/v1/apikey');
   } catch (err) {
-    if (err instanceof HeadscaleError) {
+    if (err instanceof OffscaleError) {
       return badRequest(err.status === 502 ? 'the API key was rejected by that server' : err.message);
     }
     throw err;
@@ -73,7 +73,7 @@ async function handleCollection(ctx: OfficerContext): Promise<Response> {
   const { req, userId } = ctx;
 
   if (req.method === 'GET') {
-    return Response.json({ servers: await listHeadscaleServers(userId) });
+    return Response.json({ servers: await listOffscaleServers(userId) });
   }
 
   if (req.method === 'POST') {
@@ -94,8 +94,8 @@ async function handleCollection(ctx: OfficerContext): Promise<Response> {
     if (validated instanceof Response) return validated;
 
     // First registration becomes active, so the owner is never left with servers but none selected.
-    const existing = await listHeadscaleServers(userId);
-    const server = await createHeadscaleServer({
+    const existing = await listOffscaleServers(userId);
+    const server = await createOffscaleServer({
       userId,
       name,
       url,
@@ -115,13 +115,13 @@ async function handleOne(ctx: OfficerContext, id: number, action: string | undef
 
   if (action === 'activate') {
     if (req.method !== 'POST') return methodNotAllowed();
-    const server = await setActiveHeadscaleServer(userId, id);
+    const server = await setActiveOffscaleServer(userId, id);
     return server ? Response.json({ server }) : notFound('no such server');
   }
 
   if (action === 'health') {
     if (req.method !== 'GET') return methodNotAllowed();
-    const creds = await getHeadscaleCredentials(userId, id);
+    const creds = await getOffscaleCredentials(userId, id);
     if (!creds) return notFound('no such server');
 
     const started = Date.now();
@@ -132,11 +132,11 @@ async function handleOne(ctx: OfficerContext, id: number, action: string | undef
     try {
       await createClient(creds).call('/api/v1/apikey');
     } catch (err) {
-      const message = err instanceof HeadscaleError ? err.message : 'upstream error';
+      const message = err instanceof OffscaleError ? err.message : 'upstream error';
       return Response.json({ ok: false, version: probe.version, error: message, ms: Date.now() - started });
     }
 
-    await recordHeadscaleProbe(userId, id, probe.version);
+    await recordOffscaleProbe(userId, id, probe.version);
     return Response.json({ ok: true, version: probe.version, supported: probe.supported, ms: Date.now() - started });
   }
 
@@ -146,7 +146,7 @@ async function handleOne(ctx: OfficerContext, id: number, action: string | undef
     const body = (await req.json().catch(() => null)) as Record<string, unknown> | null;
     if (!body) return badRequest('expected a JSON body');
 
-    const current = await getHeadscaleCredentials(userId, id);
+    const current = await getOffscaleCredentials(userId, id);
     if (!current) return notFound('no such server');
 
     let url: string | undefined;
@@ -177,12 +177,12 @@ async function handleOne(ctx: OfficerContext, id: number, action: string | undef
       if (validated instanceof Response) return validated;
     }
 
-    const server = await updateHeadscaleServer(userId, id, { name, url, apiKey, sshHost });
+    const server = await updateOffscaleServer(userId, id, { name, url, apiKey, sshHost });
     return server ? Response.json({ server }) : notFound('no such server');
   }
 
   if (req.method === 'DELETE') {
-    const deleted = await deleteHeadscaleServer(userId, id);
+    const deleted = await deleteOffscaleServer(userId, id);
     return deleted ? new Response(null, { status: 204 }) : notFound('no such server');
   }