SSH into a Tailscale node using Tailscale SSH (Tailscale-managed auth over WireGuard)

Documented steps

1. Tailscale SSH lets Tailscale manage authentication and authorization instead of SSH keys. The server component must run on Linux, or the macOS open-source tailscale/tailscaled CLI variant; the client can be any device running Tailscale. Requires Tailscale v1.24 or later.
2. On the target host, enable the SSH server once: `tailscale set --ssh` (or `sudo tailscale up --ssh`). This generates a host key pair, shares the public half with the control plane, and configures tailscaled to intercept inbound SSH on port 22 from the tailnet.
3. In the admin console policy file, grant SSH access with a rule: {"action":"accept", "src":["group:eng"], "dst":["tag:server"], "users":["autogroup:nonroot"]}. Supported actions are accept (auto) and check (periodic re-auth), with optional checkPeriod (default 12h) and acceptEnv.
4. From any client on the tailnet, connect with `tailscale ssh user@host` or just `tailscale ssh host` (an interactive prompt lets you pick the user). The host may be a MagicDNS name or a 100.x.y.z Tailscale IP.
5. Because Tailscale authenticates via WireGuard node keys and publishes host keys through the coordination server, there is no need to manage ~/.ssh/authorized_keys and you get no 'unknown host key' prompt; non-Tailscale SSH on the same host is unaffected.
6. For scripted/automation use, you can also run a plain `ssh user@host` if the machine is configured (Tailscale SSH also supports SFTP/SCP for newer clients).