feat: add gateway lock, shell completion, and tailscale serve (Tier 4 features 1-3)

src/cli/doctor.ts

@@ -185,6 +185,22 @@ const checkSkills: Check = async (ctx) => {
   }
 };
 
+const checkTailscale: Check = async (ctx) => {
+  if (!ctx.config?.server?.tailscale?.serve) {
+    return { status: 'skip', label: 'Tailscale Serve', detail: '(not enabled)' };
+  }
+  try {
+    const { isTailscaleAvailable } = await import('../gateway/tailscale.js');
+    const result = await isTailscaleAvailable();
+    if (result.available) {
+      return { status: 'pass', label: 'Tailscale Serve', detail: `(v${result.version})` };
+    }
+    return { status: 'fail', label: 'Tailscale Serve', detail: result.error ?? 'Tailscale not available' };
+  } catch (err) {
+    return { status: 'fail', label: 'Tailscale Serve', detail: err instanceof Error ? err.message : String(err) };
+  }
+};
+
 const allChecks: Check[] = [
   checkConfigExists,
   checkConfigParses,
@@ -196,6 +212,7 @@ const allChecks: Check[] = [
   checkTelegram,
   checkMcpServers,
   checkSkills,
+  checkTailscale,
 ];
 
 /** Run all doctor checks in order. Exported for testing. */