Let t3 service install publish over Tailscale Serve

[rubenmeza]

Existing capability: t3 serve --tailscale-serve [--tailscale-serve-port N] publishes the server inside the tailnet with Tailscale Serve, and t3 service install runs t3 serve as a background service (systemd user unit on Linux).

Gap: the two don't combine. t3 service install only accepts --base-dir and --allow-downgrade, and the unit's launcher starts t3 serve with no extra arguments. For a headless machine meant to be reached over the tailnet (an always-on desktop or a server), there is no supported way to make the service publish over Serve.

What works today (undocumented): the launcher passes its environment through, so a systemd drop-in survives reinstalls:

mkdir -p ~/.config/systemd/user/t3code.service.d
printf '[Service]\nEnvironment=T3CODE_TAILSCALE_SERVE=true\n' > ~/.config/systemd/user/t3code.service.d/tailscale.conf
systemctl --user daemon-reload && systemctl --user restart t3code.service

Editing the unit itself doesn't work: it marks the service as needing repair, and the next install or update rewrites it.

Proposal: a focused option on t3 service install, --tailscale-serve / --tailscale-serve-port, stored in the service plan and rendered into the unit (as Environment= lines or launcher arguments), with the "is the unit current" check aware of it. It controls only whether the service starts t3 serve with the existing Serve flag; no new behaviour beyond that. Until then, documenting the drop-in would help.

Related bug: Serve failures are only logged as a warning (#16238).