feat: add gateway lock, shell completion, and tailscale serve (Tier 4 features 1-3)

src/daemon/index.ts

@@ -811,6 +811,7 @@ export async function startDaemon(config: Config): Promise<DaemonContext> {
       tailscaleIdentity: config.server.tailscale_identity,
     },
     authHttp: config.server.auth_http,
+    lock: config.server.lock,
     uiDir: resolve(import.meta.dirname, '../gateway/ui'),
     config,
     channelRegistry,
@@ -1002,6 +1003,24 @@ export async function startDaemon(config: Config): Promise<DaemonContext> {
 
   await gateway.start();
 
+  // ── Tailscale Serve ────────────────────────────────────────────
+  if (config.server.tailscale?.serve) {
+    const { startTailscaleServe, stopTailscaleServe } = await import('../gateway/tailscale.js');
+    const tsConfig = {
+      localPort: config.server.port,
+      servePort: config.server.tailscale.port,
+      hostname: config.server.tailscale.hostname,
+    };
+    try {
+      await startTailscaleServe(tsConfig);
+      lifecycle.onShutdown(async () => {
+        await stopTailscaleServe(tsConfig);
+      });
+    } catch {
+      console.warn('Tailscale Serve failed to start — gateway still accessible on local port');
+    }
+  }
+
   // ── Heartbeat Monitor ──────────────────────────────────────────
   const heartbeatMonitor = new HeartbeatMonitor({
     config: config.automation.heartbeat,