Put SSH Behind Tailscale and Close Port 22

Move SSH onto a private Tailscale network and close port 22. Includes the key-expiry step that prevents lockouts, the UFW rules, and a recovery path.