tailscale-guard Production hardening toolkit for Tailscale mesh networks on Hetzner ARM64 VPS — auditd, fail2ban, Unbound, Pi-hole, Suricata IDS, iptables lockdown, interactive CLI installer