feat: add gateway lock, shell completion, and tailscale serve (Tier 4 features 1-3)

src/config/schema.ts

@@ -6,8 +6,26 @@ const telegramSchema = z.object({
   require_mention: z.boolean().default(true),
 });
 
+const tailscaleSchema = z.object({
+  /** Enable Tailscale Serve to expose gateway on tailnet. */
+  serve: z.boolean().default(false),
+  /** Custom hostname for Tailscale Serve. Defaults to machine hostname. */
+  hostname: z.string().optional(),
+  /** Tailscale Serve HTTPS port. */
+  port: z.number().default(443),
+}).default({});
+
+const pairingSchema = z.object({
+  /** Enable DM pairing codes for unknown senders. */
+  enabled: z.boolean().default(false),
+  /** Pairing code time-to-live duration (e.g. '5m', '1h'). */
+  code_ttl: z.string().default('5m'),
+  /** Length of generated pairing codes. */
+  code_length: z.number().default(6),
+}).default({});
+
 const serverSchema = z.object({
-  tailscale_only: z.boolean().default(true),
+  tailscale: tailscaleSchema,
   localhost: z.boolean().default(true),
   port: z.number().default(18800),
   /** Static bearer token for gateway auth. If set, all connections must provide it. */
@@ -16,6 +34,8 @@ const serverSchema = z.object({
   tailscale_identity: z.boolean().default(false),
   /** Apply token auth to HTTP requests too (not just WebSocket). Default: true when token is set. */
   auth_http: z.boolean().default(true),
+  /** Single-client gateway lock. When true, only one WebSocket client can be connected at a time. */
+  lock: z.boolean().default(false),
 });
 
 const modelConfigBaseSchema = z.object({