FR: iOS option to route APNS through exit node on cellular networks

### What are you trying to do?

Please consider providing an advanced option in Tailscale iOS to route Apple Push Notification service traffic through the selected exit node, especially on cellular networks.

Recently, some iOS users in mainland China have reported unreliable push notifications for apps such as Telegram, X, Reddit, and Facebook, while the apps themselves still work once opened. Community discussions suggest that APNs reachability may depend on the client’s network path or egress IP.

For Tailscale users, this makes APNs routing important: when an exit node is enabled, users may expect push notification traffic to use that exit node as well, rather than bypassing Tailscale and continuing to use the underlying cellular path.

### How should we solve this?

Please add an advanced iOS option such as:
```
Route APNs through exit node
```
or:
```
Include Apple Push Notifications in VPN routing
```
When enabled, Tailscale should configure the iOS VPN so APNs traffic is included in the tunnel where supported by iOS.

Surge already exposes a similar iOS option, include-apns, documented as making Surge VIF handle APNs traffic. Surge requires this to be used together with include-all-networks=true, which suggests this behavior is technically feasible on iOS with the right NetworkExtension configuration.

### What is the impact of not solving this?

If APNs bypasses the Tailscale exit node on iOS, users affected by APNs reachability issues on their local cellular network may still miss push notifications even when an exit node is enabled.
This weakens the practical value of using an exit node in affected regions: apps may work after being opened, but notifications can remain delayed or unavailable because APNs traffic is still using the problematic local network path instead of the selected exit node.

### Anything else?

Related discussion:

- https://www.reddit.com/r/Tailscale/comments/1qrod8s/ios_bug_allowing_traffic_to_bypass_tailscale/

Recent discussions about iOS push notification reliability:

- https://www.v2ex.com/t/1209797
- https://www.v2ex.com/t/1209839
- https://www.v2ex.com/t/1210130

Surge reference:

https://manual.nssurge.com/others/misc-options.html#include-apns