feat(tailscale): operator-set login user — VPN menu skips the sudo terminal

nomarchy.services.tailscale now makes the login user the Tailscale
operator (services.tailscale.extraSetFlags = ["--operator=<username>"],
mkDefault), so `tailscale up/down/set` — and the System → VPN menu's
Tailscale controls — run without sudo. The user is already in wheel, so
the operator grant is no real new privilege, just skips the prompt.

nomarchy-vpn's Tailscale actions are now operator-aware: a ts_priv
helper runs the subcommand inline and only falls back to a sudo terminal
if the operator grant is absent (downstream dropped it). Connect brings
an authed-but-down node up inline; a node that still needs interactive
login goes to a terminal so the auth URL is visible.

Option description + template comment updated; ROADMAP follow-up closed.
System + home builds green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -108,11 +108,13 @@ how to override it. Items marked ✓ are shipped.
     the `networkmanager-openvpn` plugin ships system-side
     (`networking.networkmanager.plugins`, mkDefault) so the openvpn type is
     available — import type is chosen by file extension.
-  - **Tailscale:** status (read-only, no privilege) + `up`/`down` + **exit-node**
-    selection. It lives outside NetworkManager, so the menu drives the
-    `tailscale` CLI directly, **self-gated** on the CLI being present
-    (= `nomarchy.services.tailscale`). Privileged actions go through a terminal +
-    `sudo` (the snapshot-tool pattern) — no operator wiring.
+  - **Tailscale:** status (read-only) + `up`/`down` + **exit-node** selection. It
+    lives outside NetworkManager, so the menu drives the `tailscale` CLI
+    directly, **self-gated** on the CLI being present (= `nomarchy.services.tailscale`,
+    which makes the login user the **operator** via `extraSetFlags`). So
+    up/down/exit-node run **inline without sudo**, falling back to a sudo terminal
+    only if the operator grant is absent; the first interactive login uses a
+    terminal (the auth URL is visible).
   Shape: a `nomarchy-menu vpn` rofi submenu under **System** — NM
   VPN/WireGuard connections shown ● active / ○ inactive and toggled on select
   (networkmanager-group users need no sudo), Import via the Files/`fd` picker
@@ -125,8 +127,8 @@ how to override it. Items marked ✓ are shipped.
   — a from-scratch WireGuard keypair/peer editor is too much rofi surface, so
   creation is deferred to `nm-connection-editor`. Eval + build green; **pending
   an on-machine check** (the nmcli import/up-down + Tailscale paths need a live
-  session with real configs). Remaining (optional): operator-set Tailscale so its
-  toggles skip the sudo terminal; richer exit-node display (country/city).
+  session with real configs). Remaining (optional): richer exit-node display
+  (country/city).
 - **Theme parity with legacy:** summer-day/night now carry their legacy
   bar layouts as `waybar.jsonc` whole-swaps (adapted: dead legacy script
   modules dropped, Nerd-Fonts-v2 codepoints remapped to FontAwesome/v3,