serve: document (and optionally automate) Tailscale Serve/Funnel for persistent HTTPS access

[OpenCodeEngineer]

Summary

Make it a one-step, documented path to expose opencode serve over HTTPS with a persistent domain using Tailscale Serve / Funnel. Today the common tunnel suggestions have papercuts: cloudflared quick tunnels (--url) mint a new random *.trycloudflare.com hostname on every restart, so saved mobile/remote connections break; ngrok needs a paid plan for a static domain. Tailscale gives a stable hostname + automatic TLS for free, which is the best default for a self-hosted agent — especially for the mobile client where a connection is saved once and reused.

Why Tailscale

• Stable domain forever — https://<machine>.<tailnet>.ts.net via MagicDNS; survives restarts.
• Automatic HTTPS — Tailscale provisions/renews a Let's Encrypt cert; no cert config.
• Two trust levels out of the box:
  • tailscale serve — HTTPS, reachable only inside your tailnet (most secure; client device just needs Tailscale).
  • tailscale funnel — same stable domain but publicly reachable for off-tailnet access.

Proposed work

1. Docs (ship first, low-risk)
Add a "Persistent HTTPS access" section to the serve docs covering:

# Private to your tailnet (recommended)
opencode serve --hostname 127.0.0.1 --port 4096
tailscale serve 4096
# → https://<machine>.<tailnet>.ts.net  (stable, auto-TLS)

# Public (off-tailnet), keep auth on:
OPENCODE_SERVER_PASSWORD=... opencode serve --hostname 127.0.0.1 --port 4096
tailscale funnel 4096

Notes to include: bind opencode to 127.0.0.1 (Tailscale terminates TLS and proxies in), keep OPENCODE_SERVER_PASSWORD set whenever Funnel is used, and how to print the URL (tailscale serve status / tailscale funnel status).

2. Optional convenience flag (follow-up)
Investigate a built-in helper so users don't run two commands:

• opencode serve --tailscale[=serve|funnel] — on startup, detect the tailscale binary, ensure the daemon is up, invoke the equivalent of tailscale serve <port> (shell out to the CLI, or use the LocalAPI), then print the resulting https://…ts.net URL in the server banner.
• Graceful fallback + clear error if Tailscale isn't installed/logged in (link to install + tailscale up).
• Tear down the serve config on shutdown so we don't leave dangling proxies.

3. Acceptance criteria

• Docs section merged with copy-paste commands for both serve and funnel.
• Restarting opencode serve keeps the same public URL (the core win over quick tunnels).
• (If flag lands) opencode serve --tailscale prints a working https://…ts.net URL and a phone/remote client can connect to it.

References

• Tailscale Serve: https://tailscale.com/kb/1242/tailscale-serve
• Tailscale Funnel: https://tailscale.com/kb/1223/funnel

Context: this is the recommended remote-access path for the community Android client (opencode-mobile), which saves a connection URL once — a stable hostname is essential there.