test(net): TLS-enabled docker stack and active e2e test

The docker-compose stack now serves Headscale (and its embedded DERP)
over TLS on port 8443 with a self-signed cert covering localhost,
127.0.0.1, and the docker-network hostname `headscale`. Tailscale
peers trust the cert via SSL_CERT_FILE; our test daemon uses
`derp_tls_insecure: true` (gated on the SUNBEAM_NET_TEST_DERP_INSECURE
env var) since pinning a self-signed root in tests is more trouble
than it's worth.

With TLS DERP working, the previously-ignored
`test_e2e_tcp_through_tunnel` test now passes: the daemon spawns,
registers, completes a Noise handshake over TLS, opens a TLS DERP
relay session, runs a real WireGuard handshake with peer-a (verified
via boringtun ↔ tailscale interop), and TCP-tunnels an HTTP GET
through smoltcp ↔ engine ↔ proxy ↔ test client. The 191-byte echo
response round-trips and the test asserts on its body.

- tests/config/headscale.yaml: tls_cert_path + tls_key_path, listen on
  8443, server_url=https://headscale:8443
- tests/config/test-cert.pem + test-key.pem: 365-day self-signed RSA
  cert with SAN DNS:localhost, DNS:headscale, IP:127.0.0.1
- tests/docker-compose.yml: mount certs into headscale + both peers,
  set SSL_CERT_FILE on the peers, expose 8443 instead of 8080
- tests/run.sh: switch to https://localhost:8443, set
  SUNBEAM_NET_TEST_DERP_INSECURE=1
- tests/integration.rs: drop the #[ignore] on test_e2e_tcp_through_tunnel,
  read derp_tls_insecure from env in all four test configs

sunbeam-net/tests/config/headscale.yaml

@@ -1,10 +1,17 @@
 # Headscale configuration for integration tests.
 # Ephemeral SQLite, embedded DERP, no OIDC.
 
-server_url: http://headscale:8080
-listen_addr: 0.0.0.0:8080
+server_url: https://headscale:8443
+listen_addr: 0.0.0.0:8443
 metrics_listen_addr: 0.0.0.0:9090
 
+# Self-signed cert covering localhost, 127.0.0.1, and the docker-network
+# hostname `headscale`. Generated by tests/run.sh on first run; the
+# integration tests connect with derp_tls_insecure: true so they don't
+# need to trust this CA.
+tls_cert_path: /etc/headscale/test-cert.pem
+tls_key_path: /etc/headscale/test-key.pem
+
 # Noise protocol (auto-generates key on first start)
 noise:
   private_key_path: /var/lib/headscale/noise_private.key