fix(tailscale): select HTTPS listeners by TLS provider

[clwsgruk]

This pull request was prepared and submitted by an AI assistant acting on behalf of @jnsgruk.

Summary

Fix per-proxy custom-domain HTTPS when using an external TLS provider such as ACME.

• Propagate the resolved TLS provider to traffic exposure.
• Use a raw tsnet listener only when external TLS termination is required.
• Preserve ListenTLS and Funnel behavior for Tailscale-managed TLS.
• Reject the unsupported combination of external custom TLS and Funnel.
• Add regression coverage for defaults, aliases, fallback behavior, errors and cleanup.

Problem

Per-proxy HTTPS listeners are currently always created with tsnet.Server.ListenTLS(). For a custom domain using ACME, the proxy manager instead needs the underlying raw listener so it can terminate TLS with the custom-domain certificate.

The mismatch causes domain setup to fail with:

get raw tcp listener: proxy port not found

Listener selection now uses the resolved TLS provider rather than simply checking whether a domain is configured.

Example setup

Cloudflare provides DNS only; traffic remains inside the tailnet.

 Cloudflare DNS (DNS-only)
 quartz.jnsgr.dev ---- CNAME ----> quartz.<tailnet>.ts.net
 notes.jnsgr.dev  ---- CNAME ----> notes.<tailnet>.ts.net
                                      |
 Tailnet client                       | HTTPS via Tailscale
      |                               |
      +-------------------------------+
                                      v
 +----------------------- Docker host -----------------------+
 |                                                           |
 |  +------------------- TSDProxy container ---------------+ |
 |  | Per-proxy tsnet nodes                                | |
 |  |   quartz     notes      tsdproxy      matrix         | |
 |  |      |         |           |             |           | |
 |  +------|---------|-----------|-------------|-----------+ |
 |         |         |           |             |             |
 |  +------v---+ +---v------+ +--v------+ +----v---------+  |
 |  | quartz-  | | notes-   | | TSDProxy| | matrix-proxy |  |
 |  | web      | | web      | | :8080   | +-------+-------+  |
 |  +----------+ +----------+ +---------+         |          |
 |                                      +---------v--------+ |
 |                                      | Continuwuity     | |
 |                                      +------------------+ |
 +-----------------------------------------------------------+

For the custom domains, TSDProxy accepts a raw tsnet connection and terminates TLS using the ACME certificate. Matrix continues to use Tailscale-managed TLS through ListenTLS.

Testing

• go test -race -count=1 ./...
• go vet ./...
• golangci-lint on the changed packages
• Live per-proxy deployment with Docker, Tailscale, Cloudflare DNS and ACME

Full-repository golangci-lint currently reports five pre-existing issues on the base commit; the changed packages report zero issues.

[almeidapaulopt]

@clwsgruk Could you rebase this onto current main? The GitHub build workflow has never run on this PR (first-contribution workflow approval gating), and a rebase would re-trigger CI so the merge decision has a fresh build behind it. The change itself reviewed well — just want the green check on record before merging.

[jnsgruk]

@almeidapaulopt done!