feat(agent): v0.3.5 Windows inbound forwarding, UI actions, lifecycle

- Configure tailscale serve automatically for each instance on Windows userspace networking.
- Add local UI buttons: start/stop/reset/delete instances (stop/start preserve volumes).
- Clean shutdown: stop tailscaled and instances, notify server with instance_stopped.
- Restart tailscaled on agent boot using persisted state when pre-auth key is absent.
- Sync instance stopped/deleted status to dashboard (server/lib/websocket.ts).
- Security: include prior authz/scoping changes across API routes, ephemeral pre-auth keys, ACL policy, internal API key.
- Update SUIVI_VPN_ONDEMAND.md and docs/ONBOARDING_CLIENT.md.
- Bump agent version to 0.3.5.

agent/docker.go

@@ -62,6 +62,20 @@ func dockerComposeDown(dataDir, instanceID string) error {
 	return cmd.Run()
 }
 
+func dockerComposeStop(dataDir, instanceID string) error {
+	dir := instanceDir(dataDir, instanceID)
+	cmd := exec.Command(getContainerEngine(), "compose", "-f", filepath.Join(dir, "docker-compose.yml"), "stop")
+	configureEngineCmd(cmd, dir)
+	return cmd.Run()
+}
+
+func dockerComposeStart(dataDir, instanceID string) error {
+	dir := instanceDir(dataDir, instanceID)
+	cmd := exec.Command(getContainerEngine(), "compose", "-f", filepath.Join(dir, "docker-compose.yml"), "start")
+	configureEngineCmd(cmd, dir)
+	return cmd.Run()
+}
+
 func dockerComposeRm(dataDir, instanceID string) error {
 	dir := instanceDir(dataDir, instanceID)
 	cmd := exec.Command(getContainerEngine(), "compose", "-f", filepath.Join(dir, "docker-compose.yml"), "down", "-v")