Share a local service or file directory with the tailnet using tailscale serve

Documented steps

1. tailscale serve exposes a local service or directory to your tailnet only (not the public internet — use `tailscale funnel` for that). CLI syntax changed in client v1.52; current form is `tailscale serve [flags] <target>`.
2. Serve a running local web server on the tailnet over HTTPS: `tailscale serve 3000` proxies https://<node>.<tailnet>.ts.net/ to http://127.0.0.1:3000. No sudo is needed for port forwarding.
3. Serve a static file directory: `sudo tailscale serve /path/to/dir` (Linux) — it becomes available under the node's serve URL. On Windows use an Administrator console instead of sudo.
4. To persist it across reboots/restarts run in the background: `tailscale serve --bg <target>`. Without --bg, a foreground serve stops on Ctrl+C and must be restarted manually after a reboot or restart (tailscale down/up).
5. Proxy a local HTTPS server that has a self-signed cert using https+insecure: `tailscale serve https+insecure://localhost:8443`.
6. Rebind a TCP service (e.g. SSH on an alternate port) to your tailnet IP: `tailscale serve --tcp 2222 22`, then connect with `ssh -p 2222 user@100.x.y.z`.
7. Stop sharing with `tailscale serve off`. Inspect current servers with `tailscale serve status` (or --json) and reset all config with `tailscale serve reset`.