feat(runtime): secure Tailscale exposure reservations (PAP-17051)

Add the bounded reserve/expose/remove broker handshake, paired-port contracts, hostname discovery, deployable systemd unit, and focused authorization/lifecycle tests.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

packages/tailscale-https-broker/package.json

@@ -10,9 +10,10 @@
     "./*": "./src/*.ts"
   },
   "bin": {
-    "paperclip-tailscale-https-broker": "./src/main.ts"
+    "paperclip-tailscale-https-broker": "./dist/main.js"
   },
   "scripts": {
+    "build": "tsc",
     "typecheck": "tsc --noEmit",
     "test": "vitest run"
   },