fix: make StartOS admin UI reachable over Tailscale

[marcwparrish]

Summary

• detect the exact StartOS admin UI route (start-os / resolved admin host / admin-ui), including legacy saved routes without hostId
• route that interface's socat hop through its directly reachable SSL bridge endpoint instead of the plaintext loopback DNAT
• preserve tcp:// as the Tailscale target in TCP mode while using the SSL bridge for the upstream hop
• preserve existing bridge-port selection for every other package interface
• document the StartOS private-domain requirement for signing in through the MagicDNS address

Root cause

The admin UI's plaintext bridge endpoint is implemented as nftables DNAT to host loopback. Traffic from the Tailscale service container crosses lxcbr0, where StartOS's disabled route_localnet setting causes that traffic to be dropped. The admin UI's SSL bridge endpoint is directly reachable from the container, so the forwarder uses the SSL bridge hostname and port returned by the SDK. Web modes dial the local forwarder with https+insecure; TCP mode remains a raw tcp:// target.

Verification

• npm ci
• npx prettier --check startos/main.ts README.md instructions.md
• npm run check
• npm run build
• git diff --check

Fixes #7.