Restrict Homelab SSH with a Least-Privilege Tailscale Policy

Limit homelab SSH by group, tagged host, and local account, require periodic re-authentication, and prove both allowed and denied paths.