[NET-01] Evaluate optional NetBird private-network integration #19

ID: NET-01. Lifecycle: requested only. Backlog: #1.

The maintainer uses NetBird. Evaluate optional NetBird-aware endpoint
advertisement/exposure without requiring Tailscale or adding another federation
layer.

What works already

Generic authenticated direct pairing can use a reachable private-network IP.
Running the fork on a NetBird-connected host and binding/advertising its private
address may be sufficient; clients can pair manually. Mesh routing does not
replace T3 authorization, and HTTPS-hosted clients still need a compatible HTTPS
backend.

T3's Tailscale integration reads local status/MagicDNS, advertises local
endpoints, manages Tailscale Serve HTTPS and probes the T3 well-known endpoint.
It does not enumerate or auto-connect to every Tailscale peer. The existing
AdvertisedEndpoint/AdvertisedEndpointProvider types are a reuse seam, not a
generic WireGuard connector API.

Important differences to preserve

• Current desktop code labels all 100.64.0.0/10 interface addresses as Tailscale.
  NetBird can use that range, so product identity cannot be inferred from it.
• NetBird's local status/API can support discovery of this host's capabilities;
  no daemon install/login/reconfigure/restart is authorized by this request.
• netbird expose publishes to the public internet and is not equivalent to
  private Tailscale Serve. Public exposure must be a separate explicit scope.
• Headscale is a Tailscale-compatible control server; verify DNS/certificate/
  Serve support instead of promising interchangeability.

Prefer the manual path first. If useful, add an optional capability-based
endpoint provider, off by default, preserving current Tailscale behavior,
environment-scoped ownership and ordinary operation without any VPN.
Peer inventory, T3 service discovery, TLS exposure and pairing are distinct.

Recorded request

• Slug: netbird-mesh-connectivity
• Branch: request/netbird-mesh-connectivity, based on 982929e93
• Request and source references
• Proposed request-branch workflow

No runtime implementation, phase advancement, VPN mutation or live reachability
test. This is a proposal for evaluation, not shipped NetBird support.

Recorded by GPT-6 Astra through GitHub Copilot CLI; no delegated inference.