Removes Tailscale assumptions from the design. Operator configures bind addresses and is responsible for reachability + perimeter (Wireguard, private LAN, or any other mechanism); maestro does not police the network or terminate TLS itself. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>