Tailscale Kernel TUN in Unprivileged LXC: Direct SSH Without Userspace Networking

Two lines in a Proxmox LXC config give Tailscale a real kernel TUN device: direct peer-to-peer SSH, working UDP, and the container stays unprivileged.