Add tailscale-proxy stack + Grafana dashboard

New stack tailscale-proxy: a LAN HTTP proxy (192.168.0.35:3128) that egresses
through the dedicated Hetzner Tailscale exit node fedora-technohim, so proxied
LAN clients appear on the internet as 89.167.72.79 without routing the docker
host itself through the tunnel.

- ts-proxy: Tailscale in userspace mode (--exit-node=100.121.234.85), exposing a
  SOCKS5 proxy on :1055. Userspace mode makes no host route/firewall changes.
- tinyproxy: LAN-facing forward proxy on :3128 (Allow 192.168.0.0/22), upstream
  socks5 to ts-proxy. Access log shipped to Alloy/Loki via the syslog
  log-driver (tag tailscale-proxy).

The Tailscale auth key stays outside Git in /mnt/containers/tailscale-proxy/
ts.env (0600); node state persists in the state/ dir. tinyproxy.conf is tracked
here as source of truth. See tailscale-proxy/README.md.

Also adds logging/grafana-dashboards/tailscale-proxy.json: a Loki dashboard
(request rate by method, top destinations, top clients, totals, live access
log) built from the tinyproxy syslog stream, matching the existing dashboards'
schemaVersion 39 + ${datasource} template-var pattern.

Full build record in ops-knowledge
diagnostics/2026-07-23-02-tekhnohim-docker-tailscale-exit-proxy-stack.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tailscale-proxy/docker-compose.yaml

@@ -0,0 +1,35 @@
+services:
+  ts-proxy:
+    image: tailscale/tailscale:v1.98.9
+    container_name: ts-proxy
+    hostname: technohim-lan-proxy
+    restart: unless-stopped
+    env_file: ["/mnt/containers/tailscale-proxy/ts.env"]
+    environment:
+      TS_HOSTNAME: technohim-lan-proxy
+      TS_STATE_DIR: /var/lib/tailscale
+      TS_USERSPACE: "true"
+      TS_ACCEPT_DNS: "false"
+      TS_EXTRA_ARGS: "--exit-node=100.121.234.85 --reset"
+      TS_TAILSCALED_EXTRA_ARGS: "--socks5-server=0.0.0.0:1055 --outbound-http-proxy-listen=0.0.0.0:1056"
+    volumes: ["/mnt/containers/tailscale-proxy/state:/var/lib/tailscale:z"]
+    networks: [proxynet]
+
+  tinyproxy:
+    image: vimagick/tinyproxy:latest
+    container_name: ts-lan-proxy
+    restart: unless-stopped
+    depends_on: [ts-proxy]
+    volumes: ["/mnt/containers/tailscale-proxy/tinyproxy.conf:/etc/tinyproxy/tinyproxy.conf:ro,z"]
+    ports: ["192.168.0.35:3128:3128"]
+    logging:
+      driver: syslog
+      options:
+        syslog-address: "udp://192.168.0.35:514"
+        syslog-format: rfc3164
+        tag: tailscale-proxy
+    networks: [proxynet]
+
+networks:
+  proxynet:
+    name: tailscale-proxynet