Advertise a physical subnet as a Tailscale subnet router and have clients accept its routes

Documented steps

1. A subnet router advertises routes to an existing physical network (e.g. 10.0.0.0/24) so other tailnet nodes can reach those devices through the router node without installing Tailscale on them.
2. On the machine acting as the router (Linux with IP forwarding enabled), advertise the routes and bring the node up: `tailscale set --advertise-routes=10.0.0.0/24` then `tailscale up` (you can also pass multiple comma-separated routes).
3. Have an admin approve the advertised routes in the admin console (Machines > Edit route settings) unless autoApprovers are set. Unapproved routes are advertised locally but not distributed.
4. On client devices, opt in to accept the routes: on Linux run `tailscale set --accept-routes` (Windows, macOS, Android, iOS accept by default; Linux clients must explicitly accept).
5. Verify reachability: `tailscale ping <router-ip>` then try to reach a device on the advertised subnet through the router (e.g. `curl http://10.0.0.5`). Check `tailscale status` that the route shows as accepted.
6. If traffic should not be NAT'd (e.g. span multiple networks), on Linux you can disable SNAT with `tailscale up --snat-subnet-routes=false`; otherwise the router SNATs so devices just see traffic from the router.
7. For a router that should also relay DNS, avoid forcing Tailscale DNS if the cloud manages it: use `--accept-dns=false` on the router where appropriate.