Author the least-privilege Tailscale policy with the wildcard grant kept

Rewrite `terraform/alunduil/tailscale-acl.hujson` from the factory default
(fully open `* → * → *`) to the least-privilege model below, keeping the
wildcard grant so no live session drops while the migration lands. The device
tags these grants target come in #514; the wildcard comes out in #515.

## Target access model

- **alunduil**: full access to all infrastructure and own devices; SSH
(non-root, check mode) to servers and infra.
- **sentinger53**: exit-node selection only (all three exit nodes); no service
access, no SSH.
- **tabultrac**: exit-node access, under the alunduil account and so covered by
the owner grant.
- **Everyone else**: implicit deny — real once #515 lands.

Tags: `tag:server` → homeassistant, truenas-scale; `tag:infra` → nanopi-neo3.

## Policy file

```hujson
"tagOwners": {
"tag:terraform": ["autogroup:admin"],
"tag:server": ["autogroup:admin", "tag:terraform"],
"tag:infra": ["autogroup:admin", "tag:terraform"],
},

"grants": [
{"src": ["*"], "dst": ["*"], "ip": ["*"]},

{"src": ["alunduil@gmail.com"], "dst": ["tag:server", "tag:infra", "autogroup:self", "autogroup:internet"], "ip": ["*"]},
{"src": ["sentinger53@gmail.com"], "dst": ["autogroup:internet"], "ip": ["*"]},
],

"ssh": [
{
"action": "check",
"src": ["alunduil@gmail.com"],
"dst": ["tag:server", "tag:infra"],
"users": ["autogroup:nonroot"],
},
],
```

`tag:terraform` never lands on a device. It exists so the read-write trust
credential can hold one tag that owns both device tags, which is what lets
#514 assign `tag:server` and `tag:infra` to different devices. Granting the
credential those two tags directly would only permit applying both to every
device. `autogroup:admin` stays on all three so the console remains a
break-glass path.

alunduil's grant names destinations rather than `*` because sentinger53's
devices are neither infrastructure nor alunduil's own, and the access model
doesn't reach them.

The SSH rule replaces the factory `autogroup:member → autogroup:self` rule
outright, so sentinger53 loses SSH to their own devices and root logins go
away everywhere.

## Why the wildcard stays

The three devices are still untagged at this point, so `tag:server` and
`tag:infra` match nothing. The wildcard is what keeps sentinger53's exit-node
selection and every device-to-device path up until #514 applies.

## SPDX header

`tailscale-acl.hujson` carries no inline header today; a `REUSE.toml`
annotation covers it, because the file had to match the tailnet's copy byte
for byte for the import to plan clean. This change rewrites the policy anyway,
so move the SPDX pair into the file as leading `//` comments and drop the
annotation block from `REUSE.toml`. Tailscale preserves HuJSON comments — the
imported default opens with one above the `{`.

Part of #96.