A rebuilt NanoPi-NEO3 rejoins the tailnet as an approved exit node

Make a rebuilt NanoPi-NEO3 come back as an approved exit node from the one
break-glass SSH session recovery already includes — no console clicking, and
no credential that outlives the recovery.

## What ADR 0002 already settled

[ADR 0002][adr] decides the identity doesn't travel on the card. The
published image is public, so it carries no auth key, no OAuth client secret
and no `/var/lib/tailscale`. Two of the three approaches this issue
originally offered are closed by that record: cloning the running card is
rejected for carrying host keys and tailnet state offsite in the clear, and
folding a credential into the image contradicts what the image is allowed to
hold. Auth keys also cap at 90 days with no non-expiring variant, so a
credential pre-positioned on a spare card rots long before it's needed.

What remains is the credential the operator supplies to #261's configuration
script during that session, and the tailnet-side setup that turns one
`tailscale up` into an approved exit node.

## Scope

- Add `"autoApprovers": {"exitNode": ["tag:infra"]}` to
`terraform/alunduil/tailscale-acl.hujson`. Without it a rebuilt node
advertises `0.0.0.0/0` and `::/0` and then waits for someone to enable
them. `tailscale_device_subnet_routes` does enable them, but only on the
next apply — and apply runs on merge to `main`, which isn't a step the
recovery procedure can take.
- Write the how-to for the recovery auth key: tagged `tag:infra`,
pre-approved, single-use, shortest usable expiry, revoked when recovery
finishes. Pre-approved is what clears `devices_approval_on = true` in
`terraform/alunduil/tailscale.tf`; tagged is what puts the node under the
tag-scoped grants and disables key expiry at first authentication. Record
where the key is handed to the configuration script.
- Handle the stale device. `local.tailscale_node_ids` keys on the leading
label of the device name, so a second `nanopi-neo3` registers as
`nanopi-neo3-1` and the `nanopi-neo3` entry the routes resource reads keeps
pointing at the dead node. Either remove the old device before the new one
authenticates, or make the recovery procedure say so.

## Acceptance criteria

- [ ] A node authenticating with the documented auth key joins without a
console approval step, and its exit-node routes are enabled without one.
- [ ] The how-to states how the key is created, tagged, scoped, supplied and
revoked.
- [ ] No auth key and no tailnet state reaches the published image or the
Drive backup.

## Sequencing

Blocked by #98, which declares `tag:infra`; #514, which tags the device so
`autoApprovers` matches something; and #261, which writes the script that
consumes the key.

#517 isn't a blocker. It holds expiry open on the *existing* exit nodes; a
rebuilt node authenticating under a tag for the first time gets expiry
disabled by that authentication.

Part of #96. Surfaced by alunduil/blog.alunduil.com#209.

[adr]: https://github.com/alunduil/alunduil-infrastructure/blob/main/docs/adr/0002-build-nanopi-neo3-recovery-image-with-armbian.md