Go library: let a program decide per client whether it may connect (Server.AllowClient)

Server.AllowedClients and AddAllowedClient admit a fixed list of node keys. A program embedding tailcat that decides at runtime which clients may connect, for example from a database or a directory service, has to know every key before Start or keep the list current itself, and it can never turn a key down once it has been added.

AllowProxy already shows the shape that fits: a func(...) bool hook the server consults at the moment of the decision. I'd like the same for client admission:

// AllowClient, if non-nil, reports whether the client with node key k
// may connect.
AllowClient func(k key.NodePublic) bool

Proposed semantics, in addition to the list rather than replacing it: a key in AllowedClients is admitted without consulting the hook, any other key is admitted if the hook approves it, and with neither configured the server stays open to all clients as it is today. Rejected clients are ignored the same way unlisted ones are, and asked about again when they retry their meow.

One design question I'd like a maintainer's view on. onMeow runs the admission check under the backend's mutex, which peerByIP and peerForIP on the data path also take. The simplest version keeps the hook there and documents that it must return quickly and not do I/O, so a program gating on an external service caches that service's decisions for the hook to look up. The alternative is a blocking-capable hook, func(ctx context.Context, k key.NodePublic) bool, which needs the check moved out of the lock, a context canceled at Server.Close, and deduplication of the client's once-a-second meow retries while a decision is pending. The client also gives up after 10 seconds, so a slow decision still has a hard ceiling. I have the non-blocking version ready as a pull request and can rework it to the blocking one if that's preferred.

No CLI change is involved; --allow keeps working as is.

Start at onMeow and compare its admission path with the existing AllowProxy hook, paying attention to the backend mutex also used by peerByIP and peerForIP. Resolve whether the hook remains non-blocking or supports context cancellation, then verify that AllowedClients, hook-approved keys, rejected retries, and the existing --allow behavior match the agreed semantics.