feat(headscale): add headplane web UI at /admin

Integrate headplane (ghcr.io/tale/headplane) into the headscale stack, served
by Caddy at /admin. API-only (no Docker socket); deploy.sh mints a headscale
API key on first run, generates headplane.yaml, and wires optional OIDC login
via pocket-id (second client, /admin/oidc/callback). Adds HEADPLANE_* env,
compose service, Caddy routing; rebuild embedded archive.

deployments/headscale/Caddyfile

@@ -11,14 +11,24 @@
 {$HEADSCALE_DOMAIN} {
     encode zstd gzip
 
-    reverse_proxy headscale:8080 {
-        header_up X-Real-IP {http.request.remote.host}
-        # Long-lived noise/wireguard control streams; lift the default
-        # idle limit so they don't get torn down.
-        flush_interval -1
-        transport http {
-            read_timeout  10m
-            write_timeout 10m
+    # Headplane web UI lives at /admin. Pass the path through unchanged
+    # (headplane serves itself under /admin). Everything else is headscale's
+    # control protocol.
+    @admin path /admin /admin/*
+    handle @admin {
+        reverse_proxy headplane:3000
+    }
+
+    handle {
+        reverse_proxy headscale:8080 {
+            header_up X-Real-IP {http.request.remote.host}
+            # Long-lived noise/wireguard control streams; lift the default
+            # idle limit so they don't get torn down.
+            flush_interval -1
+            transport http {
+                read_timeout  10m
+                write_timeout 10m
+            }
         }
     }