tailscale-proxy: add 3proxy SOCKS5 front (:1080)

Adds a LAN-facing SOCKS5 proxy alongside the existing tinyproxy HTTP proxy,
both egressing through the same Tailscale exit node.

- new service socks5 (ghcr.io/3proxy/3proxy): SOCKS5 on 192.168.0.35:1080,
  auth iponly / allow 192.168.0.0/22, chained via `parent socks5 ts-proxy 1055`
  to the Tailscale userspace SOCKS5, so clients exit as 89.167.72.79.
- 3proxy.cfg tracked here as source of truth; access log shipped to Loki via
  the syslog log-driver (tag tailscale-socks5).

Verified: curl --socks5 / --socks5-hostname 192.168.0.35:1080 -> 89.167.72.79,
wikipedia 200. Carries TCP only (no QUIC/UDP), same as the HTTP front - README
updated to note this.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tailscale-proxy/docker-compose.yaml

@@ -30,6 +30,21 @@ services:
         tag: tailscale-proxy
     networks: [proxynet]
 
+  socks5:
+    image: ghcr.io/3proxy/3proxy:latest
+    container_name: ts-lan-socks5
+    restart: unless-stopped
+    depends_on: [ts-proxy]
+    volumes: ["/mnt/containers/tailscale-proxy/3proxy.cfg:/etc/3proxy/3proxy.cfg:ro,z"]
+    ports: ["192.168.0.35:1080:1080"]
+    logging:
+      driver: syslog
+      options:
+        syslog-address: "udp://192.168.0.35:514"
+        syslog-format: rfc3164
+        tag: tailscale-socks5
+    networks: [proxynet]
+
 networks:
   proxynet:
     name: tailscale-proxynet