The Tailscale operator v0.40+ requires a ProxyGroup CRD to actually
expose services via the operator - annotations on the Service alone
are insufficient. This adds the missing ProxyGroup resource.
Also fixes the tailnet kustomization.yaml which referenced proxygroup
files that did not exist in that directory (they live in controllers/
and are deployed separately).
