feat(tailscale): add operator authkey secret and rtx6000-brain TsProxy

- Add SOPS-encrypted tailscale-operator-authkey secret for operator auth
- Add TsProxy to expose rtx6000-brain-service on tailnet (port 8000)
- Enable trade-dashboard TsProxy (was waiting for operator install)

apps/base/customer1/trade-dashboard/kustomization.yaml

@@ -5,4 +5,4 @@ resources:
   - deployment.yaml
   - service.yaml
   - configmap.yaml
-  # - tsproxy.yaml  # TODO: enable after Tailscale operator is installed
+  - tsproxy.yaml

infrastructure/controllers/base/tailscale/authkey-secret.enc.yaml

@@ -0,0 +1,23 @@
+apiVersion: ENC[AES256_GCM,data:R/0=,iv:PUqVQ0H2SZdXZkCiaSdz0ysy7wTTtE1+v25UqgXdX1c=,tag:j6+gB/gKyxuXBrsjt7OsHQ==,type:str]
+kind: ENC[AES256_GCM,data:p+MMCOMS,iv:rCfu2I31ot6oCqIHcr3FwimOYl2qDpifkTaCZmN3Ah0=,tag:dikURqRMZDS7m7kdbefa7w==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:6VEI/ZBaa3RmcuNNt8GRLanuvReC8P3FUSc=,iv:AI4A5cN20JV7Qdb/POLrJH3BUpfpAb9ybu6rABSEy/Q=,tag:fGZi0hQFpmT5jOnvVTvXvw==,type:str]
+    namespace: ENC[AES256_GCM,data:RvEu7ZA3W64Y,iv:wP45Ik04OW8Qz6DnyO3zymQMEQvJOyshTgVvLkqPUbU=,tag:PrdXhIVgnjRCNvv0c2uXGg==,type:str]
+type: ENC[AES256_GCM,data:X8Eu6/NT,iv:c6vQILIOdMZBJOzfDxOBfMZjBKyxgtHOCj6CIB9Mssc=,tag:3K38oNZpBzroLKetuFHSYQ==,type:str]
+stringData:
+    authkey: ENC[AES256_GCM,data:6bfaUzy0icgmy7panoJAIMtdhMl55ClYGi+VmBlnwrYTo1z5Cs18C0HAMozFDaevfGbaFGtEdmsyZVPKjg==,iv:g8z8QwCDA/IuUFGYNzyKW/MgqCZfaRWfWlTk65Hsvdc=,tag:irs0M4aUL35WdYUD+o2aCg==,type:str]
+sops:
+    age:
+        - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFY1Vjd1p3M2Q4eFkwdE5i
+            SExndHAxSTByZmZYd0ZpS21DY1VGZlJxNVZnCllYcGpCY05FUzdXVXVuMHAreGMy
+            b0FDRCsxNmprQ0xZRlFKYjFCMW9MSVkKLS0tIDJBR0hwaXFBb3VMS0pta29nRWpv
+            di9LZ2NRMnhTT3RmZzgrbUV6eGNKVTgKpPITr4gtgEd+Sb4bqkBdGrHfmmSxp3pU
+            sA61aRNncplQRqcYiupDlxddM25kLgK95igM0D9bZMnf98esaMW0tQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-05-03T23:29:13Z"
+    mac: ENC[AES256_GCM,data:gdqeJQuzRC58jNwISj/UXrYFTy1HrgG1Br5bTUZ/4WT0fyraVlKyPcnl6GO7Ljf1YH8ZYeOnCDqA31/ufJuILUuTiGT77qtPRHgXy0AGtlcdFoXcSrqDUGDjyfMupCgAZGviEaIWARau1cN1/jO+IFnhTcCaAYF4sykc1k3QU3o=,iv:nzYIC1WqDijUeo/v/K1rxp/b4UgvsvEdNzcN7D0n5YQ=,tag:k7+I9dMRg+AMnCF0Zog9pg==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.12.2

infrastructure/controllers/base/tailscale/kustomization.yaml

@@ -4,3 +4,5 @@ resources:
   - namespace.yaml
   - repository.yaml
   - release-operator.yaml
+  - authkey-secret.enc.yaml
+  - tsproxy-rtx6000.yaml

infrastructure/controllers/base/tailscale/tsproxy-rtx6000.yaml

@@ -0,0 +1,9 @@
+apiVersion: tailscale.com/v1
+kind: TsProxy
+metadata:
+  name: rtx6000-brain
+  namespace: customer1
+spec:
+  serviceName: rtx6000-brain-service
+  servicePort: 8000
+  hostname: rtx6000-brain