feat(agent): v0.3.5 Windows inbound forwarding, UI actions, lifecycle

- Configure tailscale serve automatically for each instance on Windows userspace networking.
- Add local UI buttons: start/stop/reset/delete instances (stop/start preserve volumes).
- Clean shutdown: stop tailscaled and instances, notify server with instance_stopped.
- Restart tailscaled on agent boot using persisted state when pre-auth key is absent.
- Sync instance stopped/deleted status to dashboard (server/lib/websocket.ts).
- Security: include prior authz/scoping changes across API routes, ephemeral pre-auth keys, ACL policy, internal API key.
- Update SUIVI_VPN_ONDEMAND.md and docs/ONBOARDING_CLIENT.md.
- Bump agent version to 0.3.5.

docker-compose.yml

@@ -34,6 +34,8 @@ services:
       MAIN_DOMAIN: ${MAIN_DOMAIN}
       HEADSCALE_URL: ${HEADSCALE_URL}
       HEADSCALE_AUTH_KEY: ${HEADSCALE_AUTH_KEY}
+      HEADSCALE_API_KEY: ${HEADSCALE_API_KEY}
+      INTERNAL_API_KEY: ${INTERNAL_API_KEY}
     depends_on:
       postgres:
         condition: service_healthy
@@ -66,7 +68,7 @@ services:
     devices:
       - /dev/net/tun:/dev/net/tun
     environment:
-      TS_AUTHKEY: ${HEADSCALE_AUTH_KEY}
+      TS_AUTHKEY: ${HEADSCALE_RESOLVER_AUTH_KEY}
       TS_LOGIN_SERVER: ${HEADSCALE_URL}
       TS_EXTRA_ARGS: --login-server=${HEADSCALE_URL}
       TS_STATE_DIR: /var/lib/tailscale