headscale: promote from _dev, split README into per-task docs

Move step-by-step guides into headscale/docs/, slim README to a quick
reference, and use $HEADSCALE_CONTAINER for docker exec commands.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

headscale/docs/connect-lan-node.md

@@ -0,0 +1,26 @@
+# Connect the LAN Node
+
+[← Back to README](../README.md)
+
+On the **LAN node** (the Docker host running Jellyfin etc.), install the Tailscale client.
+
+**Debian/Ubuntu:**
+```bash
+curl -fsSL https://tailscale.com/install.sh | sh
+sudo systemctl enable --now tailscaled
+```
+
+**Arch:**
+```bash
+sudo pacman -S tailscale
+sudo systemctl enable --now tailscaled
+```
+
+Then on any distro:
+```bash
+sudo tailscale up --login-server=https://headscale.example.com --authkey <YOUR-PREAUTH-KEY>
+```
+
+Firewall: allow UDP 41641 for direct WireGuard connections (Tailscale falls back to slower DERP relays if blocked).
+
+To reach *other* LAN devices through this node, see [Subnet Routing](subnet-routing.md).