test(net): add integration test harness against Headscale

Spins up Headscale 0.23 (with embedded DERP) plus two Tailscale peers
in docker compose, generates pre-auth keys, and runs three integration
tests behind the `integration` feature:

- test_register_and_receive_netmap: full TS2021 → register → first
  netmap fetch
- test_proxy_listener_accepts: starts the daemon and waits for it to
  reach the Running state
- test_daemon_lifecycle: full lifecycle including DERP connect, then
  clean shutdown via the DaemonHandle

Run with `sunbeam-net/tests/run.sh` (handles compose up/down + auth
key provisioning) or manually via cargo nextest with the env vars
SUNBEAM_NET_TEST_AUTH_KEY and SUNBEAM_NET_TEST_COORD_URL set.

sunbeam-net/tests/config/headscale.yaml

@@ -0,0 +1,44 @@
+# Headscale configuration for integration tests.
+# Ephemeral SQLite, embedded DERP, no OIDC.
+
+server_url: http://headscale:8080
+listen_addr: 0.0.0.0:8080
+metrics_listen_addr: 0.0.0.0:9090
+
+# Noise protocol (auto-generates key on first start)
+noise:
+  private_key_path: /var/lib/headscale/noise_private.key
+
+# Ephemeral SQLite
+database:
+  type: sqlite
+  sqlite:
+    path: /tmp/headscale.db
+
+ip_prefixes:
+  - 100.64.0.0/10
+  - fd7a:115c:a1e0::/48
+
+# Embedded DERP relay — clients can relay through Headscale itself
+derp:
+  server:
+    enabled: true
+    region_id: 999
+    region_code: test
+    region_name: "Integration Test"
+    stun_listen_addr: 0.0.0.0:3478
+    private_key_path: /var/lib/headscale/derp_server_private.key
+  urls: []
+  auto_update_enabled: false
+
+dns:
+  magic_dns: false
+  base_domain: test.sunbeam.internal
+
+prefixes:
+  v4: 100.64.0.0/10
+  v6: fd7a:115c:a1e0::/48
+  allocation: sequential
+
+log:
+  level: warn