[Feature]: Support for Tailscale mesh network endpoints (CGNAT IPs and MagicDNS domain names)

Area

Discovery or pairing

User problem

Note: This feature request includes AI generated suggestions (Google's Antigravity). I have marked
form sections where I lack context knowledge.

When attempting to connect a device (such as a MacBook Pro) located outside the local physical network using
Tailscale, PAIR is unable to connect to the remote LLM or register the remote machine as a node.

Specifically:

1. Automatic Discovery Fails: mDNS discovery does not span across subnets or overlay networks without
   explicit multicast forwarding.
2. Manual IP Addition Fails: Adding a node manually using its Tailscale IPv4 address (100.64.x.x CGNAT
   range) fails to establish pairing or route requests.
3. MagicDNS Hostnames Fail: Adding a node using its Tailscale domain name
   (e.g., macbook-pro.tailnet- name.ts.net) is either rejected by host validation or fails during probe/pairing.

As a result, users working remotely cannot access their home/office PAIR cluster's LLM resources or contribute remote nodes to an existing cluster.

Desired outcome

Tailscale & VPN Node Pairing: Users should be able to manually add out-of-network nodes by entering
either their Tailscale IP address (100.64.0.0/10) or MagicDNS domain name in the "Add Node" interface.

Alternatives considered

I tried an OpenVPN connection instead of Tailscale and had the same user problem.

Compatibility and security implications

Note: these are AI generated suggestions (Google's Antigravity) that I am not certain of.

• Address Scoring: Updating services/shared/netpick so that explicit manual node additions for CGNAT
  (100.64.0.0/10) and virtual interface addresses (tailscale0, utun) are not demoted below unreachable
  physical LAN interfaces.
• DNS & FQDN Support: Ensuring nvpair-manual-nodes and cluster pairing clients perform asynchronous DNS
  re-resolution for MagicDNS domain names (.ts.net).
• mTLS & SANs: Ensuring TLS certificates issued during PIN pairing include MagicDNS hostnames and
  Tailscale IP addresses in Subject Alternative Names (SANs).
• Security: PAIR's PIN pairing, identity verification, and mTLS traffic encryption will protect
  communication even over external overlay networks.

Validation approach

1. Set up a PAIR host on a local network equipped with Tailscale.
2. Connect a remote device (e.g., MacBook Pro on cellular/external Wi-Fi) to the same Tailscale network
   (Tailnet).
3. Open PAIR UI on the host, select Add Node, and input the MacBook Pro's Tailscale IP (100.64.x.y) or
   MagicDNS domain.
4. Verify PIN pairing completes successfully, telemetry/node-info populates, and inference requests route to
   the remote node.

Confirmations

• I searched existing issues for duplicates.
• I agree to follow the Code of Conduct.

Start by tracing the Add Node flow for manual addresses and pairing, then inspect services/shared/netpick and nvpair-manual-nodes. Check how host validation, DNS resolution, PIN pairing, and certificate SANs are handled for node endpoints. Done means a Tailscale IP or MagicDNS name can complete pairing, populate node information, and route inference requests in the validation setup.