Remove the wildcard grant from the Tailscale policy file

Delete the `{"src": ["*"], "dst": ["*"], "ip": ["*"]}` grant from
`terraform/alunduil/tailscale-acl.hujson`. Everything the tailnet needs is
already expressed by the user-scoped grants #98 adds and the device tags #514
applies; the wildcard is the safety net that lets those two land without
dropping a live session.

Removing it makes the implicit deny real. Anything no grant names stops
working — including sentinger53's device-to-device paths, which the target
access model deliberately doesn't grant.

Don't open this until the verification in #514 has passed: a client at home
reaching servers and infra as alunduil, and sentinger53 selecting an exit
node.

Blocked by #514. Part of #96.