The Tailscale operator v0.40+ requires a ProxyGroup CRD to actually
expose services via the operator - annotations on the Service alone
are insufficient. This adds the missing ProxyGroup resource.
Also fixes the tailnet kustomization.yaml which referenced proxygroup
files that did not exist in that directory (they live in controllers/
and are deployed separately).
TsProxy is not a CRD shipped by the Tailscale operator (v1.96.x).
The operator provides: ProxyClass, ProxyGroup, ProxyGroupPolicy,
DNSConfig, Tailnet, Connector, and Recorder.
Replace TsProxy with ProxyGroup (type: ingress) and annotate
rtx6000-brain-service with tailscale.com/proxy-group to expose
the vLLM endpoint via MagicDNS at rtx6000-brain-0.<tailnet>.ts.net:8000.
