Infra — auth

To be written (skeleton). Planned content: auth model (Tunnel + Tailscale + reverse proxy) and the WHY. Operational config and secrets stay private.