feat(agent): v0.3.5 Windows inbound forwarding, UI actions, lifecycle

- Configure tailscale serve automatically for each instance on Windows userspace networking.
- Add local UI buttons: start/stop/reset/delete instances (stop/start preserve volumes).
- Clean shutdown: stop tailscaled and instances, notify server with instance_stopped.
- Restart tailscaled on agent boot using persisted state when pre-auth key is absent.
- Sync instance stopped/deleted status to dashboard (server/lib/websocket.ts).
- Security: include prior authz/scoping changes across API routes, ephemeral pre-auth keys, ACL policy, internal API key.
- Update SUIVI_VPN_ONDEMAND.md and docs/ONBOARDING_CLIENT.md.
- Bump agent version to 0.3.5.

headscale/acl_policy.hujson

@@ -0,0 +1,18 @@
+{
+  "tagOwners": {
+    "tag:student-agent": ["studioe5@studioe5.local"],
+    "tag:resolver": ["resolver@studioe5.local"]
+  },
+  "acls": [
+    {
+      "action": "accept",
+      "src": ["tag:resolver"],
+      "dst": ["tag:student-agent:*"]
+    },
+    {
+      "action": "accept",
+      "src": ["tag:student-agent"],
+      "dst": ["tag:resolver:2020"]
+    }
+  ]
+}

headscale/config.yaml

@@ -38,6 +38,10 @@ database:
   sqlite:
     path: /etc/headscale/db.sqlite
 
+policy:
+  path: /etc/headscale/acl_policy.hujson
+  mode: file
+
 log:
   format: text
   level: info