Fleet P1: BYO Tailscale + network metrics, Tailscale SSH, exec hardening

Security hardening:
- The gateway no longer sends arbitrary shell to nodes. The WSS exec op is
  replaced by a typed `verify` op the daemon runs itself (fixed host+docker
  check); future container ops are typed too. cm-api NodeHub.verify() + the
  daemon's handle_command only dispatches vetted ops.

BYO Tailscale:
- migrations/0019_workspace_tailscale.sql + cm-db fleet_tailscale repo (store the
  user's Tailscale API key + tailnet, server-side only).
- cm-api routes/tailscale.rs: POST/GET/DELETE /api/fleet/tailscale + GET
  /api/fleet/tailscale/devices (proxies api.tailscale.com device list).
- Daemon: --tailscale-authkey → `tailscale up --authkey … --ssh` (enables
  Tailscale SSH for keyless user access); else `tailscale set --ssh=true`. Reports
  its tailscale IP (already).

UI:
- Fleet overview gains a Tailscale section: connect (key+tailnet) + live tailnet
  device status (online/last-seen/IP/os). Node cards show a copyable Tailscale SSH
  target (ssh <ip>).

Remaining: P2 — RemoteDriver + placement (run agents on nodes) and the in-UI
remote terminal (PTY proxied over the WSS channel).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

crates/cm-api/src/routes/mod.rs

@@ -20,6 +20,7 @@ pub mod sessions;
 pub mod skills;
 pub mod slack;
 pub mod structure;
+pub mod tailscale;
 pub mod team;
 pub mod teams;
 pub mod terminal;

crates/cm-api/src/routes/nodes.rs

@@ -109,12 +109,7 @@ pub async fn exec_test(
     let node = nodes::get(&state.pool, node_id, user.workspace_id)
         .await?
         .ok_or(ApiError::NotFound)?;
-    let cmd = vec![
-        "sh".to_owned(),
-        "-lc".to_owned(),
-        "uname -a; echo '---'; docker version --format 'docker {{.Server.Version}}' 2>/dev/null || echo 'docker: not found'".to_owned(),
-    ];
-    match state.node_hub.exec(node_id, &cmd).await {
+    match state.node_hub.verify(node_id).await {
         Ok(out) => Ok(Json(json!({ "ok": out.ok, "output": out.output, "node": node.name }))),
         Err(e) => Ok(Json(json!({ "ok": false, "output": e, "node": node.name }))),
     }

crates/cm-api/src/routes/tailscale.rs

@@ -0,0 +1,95 @@
+//! Bring-your-own Tailscale: connect a workspace's tailnet (store its API key)
+//! and proxy the Tailscale device list for fleet network metrics. The API key is
+//! used server-side only (never returned to the client).
+
+use axum::extract::State;
+use axum::Json;
+use cm_db::repo::fleet_tailscale;
+use serde::Deserialize;
+use serde_json::{json, Value};
+
+use crate::{ApiError, AppState, Authed};
+
+#[derive(Deserialize)]
+pub struct ConnectReq {
+    #[serde(rename = "apiKey")]
+    pub api_key: String,
+    pub tailnet: String,
+}
+
+/// `POST /api/fleet/tailscale` — store the workspace's Tailscale API key + tailnet.
+pub async fn connect(
+    State(state): State<AppState>,
+    Authed(user): Authed,
+    Json(req): Json<ConnectReq>,
+) -> Result<Json<Value>, ApiError> {
+    let api_key = req.api_key.trim();
+    let tailnet = req.tailnet.trim();
+    if api_key.is_empty() || tailnet.is_empty() {
+        return Ok(Json(json!({ "ok": false, "error": "apiKey and tailnet are required" })));
+    }
+    fleet_tailscale::set(&state.pool, user.workspace_id, api_key, tailnet).await?;
+    Ok(Json(json!({ "ok": true, "tailnet": tailnet })))
+}
+
+/// `GET /api/fleet/tailscale` — whether Tailscale is connected (+ the tailnet).
+pub async fn status(
+    State(state): State<AppState>,
+    Authed(user): Authed,
+) -> Result<Json<Value>, ApiError> {
+    let conn = fleet_tailscale::get(&state.pool, user.workspace_id).await?;
+    Ok(Json(json!({ "connected": conn.is_some(), "tailnet": conn.map(|(_, t)| t) })))
+}
+
+/// `DELETE /api/fleet/tailscale` — disconnect Tailscale.
+pub async fn disconnect(
+    State(state): State<AppState>,
+    Authed(user): Authed,
+) -> Result<Json<Value>, ApiError> {
+    fleet_tailscale::delete(&state.pool, user.workspace_id).await?;
+    Ok(Json(json!({ "ok": true })))
+}
+
+/// `GET /api/fleet/tailscale/devices` — proxy the Tailscale tailnet device list
+/// (online/last-seen/IP/version) for the Fleet network overview.
+pub async fn devices(
+    State(state): State<AppState>,
+    Authed(user): Authed,
+) -> Result<Json<Value>, ApiError> {
+    let Some((api_key, tailnet)) = fleet_tailscale::get(&state.pool, user.workspace_id).await? else {
+        return Ok(Json(json!({ "connected": false, "devices": [] })));
+    };
+    let url = format!("https://api.tailscale.com/api/v2/tailnet/{tailnet}/devices");
+    let resp = reqwest::Client::new().get(&url).bearer_auth(&api_key).send().await;
+    let body = match resp {
+        Ok(r) if r.status().is_success() => r.json::<Value>().await.unwrap_or_else(|_| json!({})),
+        Ok(r) => {
+            return Ok(Json(
+                json!({ "connected": true, "tailnet": tailnet, "error": format!("tailscale api {}", r.status()), "devices": [] }),
+            ));
+        }
+        Err(e) => {
+            return Ok(Json(
+                json!({ "connected": true, "tailnet": tailnet, "error": e.to_string(), "devices": [] }),
+            ));
+        }
+    };
+    let devices: Vec<Value> = body
+        .get("devices")
+        .and_then(Value::as_array)
+        .map(|arr| {
+            arr.iter()
+                .map(|d| {
+                    json!({
+                        "name": d.get("hostname").or_else(|| d.get("name")).and_then(Value::as_str),
+                        "addr": d.get("addresses").and_then(Value::as_array).and_then(|a| a.first()).and_then(Value::as_str),
+                        "os": d.get("os").and_then(Value::as_str),
+                        "version": d.get("clientVersion").and_then(Value::as_str),
+                        "lastSeen": d.get("lastSeen").and_then(Value::as_str),
+                    })
+                })
+                .collect()
+        })
+        .unwrap_or_default();
+    Ok(Json(json!({ "connected": true, "tailnet": tailnet, "devices": devices })))
+}