[Deployment] Separate public reader and tailnet-only administration services

[troyscott]

Outcome

Deploy independent processes and network paths for immutable public reading and private administration.

Acceptance criteria

• Reader and admin listen on distinct loopback ports.
• Tailscale Funnel targets only the reader.
• Tailscale Serve targets only the admin service on a different port.
• Admin identity headers are trusted only from the private proxy.
• External tests cannot reach any admin or mutation route.