feat(headscale): add headplane web UI at /admin

Integrate headplane (ghcr.io/tale/headplane) into the headscale stack, served
by Caddy at /admin. API-only (no Docker socket); deploy.sh mints a headscale
API key on first run, generates headplane.yaml, and wires optional OIDC login
via pocket-id (second client, /admin/oidc/callback). Adds HEADPLANE_* env,
compose service, Caddy routing; rebuild embedded archive.

deployments/headscale/docker-compose.yml

@@ -14,6 +14,7 @@ name: headscale
 
 volumes:
   headscale-data:
+  headplane-data:
   caddy-data:
   caddy-config:
 
@@ -63,3 +64,19 @@ services:
       timeout: 5s
       retries: 3
       start_period: 10s
+
+  # ---------------------------------------------------------------------------
+  # Headplane — web UI for headscale, served by Caddy at /admin. API-only:
+  # talks to the headscale API with a key (no Docker socket, no host control).
+  # config.yaml is generated by deploy.sh from .env.
+  # ---------------------------------------------------------------------------
+  headplane:
+    image: ghcr.io/tale/headplane:${HEADPLANE_TAG:-latest}
+    container_name: headplane
+    restart: unless-stopped
+    volumes:
+      - ./headplane.yaml:/etc/headplane/config.yaml:ro
+      - headplane-data:/var/lib/headplane
+    depends_on:
+      headscale:
+        condition: service_healthy