docs: Tailscale SSH ACL set to accept

Tailnet SSH policy changed from the default action:"check" to accept. The
effective policy is now a single rule covering all tailnet nodes, with no
expiry and port forwarding allowed, so the per-device ~12h grants and the
browser re-auth prompt are gone.

Verified unattended with BatchMode=yes: a plain command, a -L forward
returning HTTP 302, and the Herdr fallback leg.

Records the trade-off: check acted as a second factor, so a compromised
tailnet device now reaches root on Unraid without a further step.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/14-HERDR-REMOTE-MACHINES.md

@@ -81,22 +81,23 @@ failed first attempt would consume stdin and corrupt the retry. It costs about
 245 ms on the success path. `HERDR_VIA_TARGET=lan|ts` forces a leg for testing;
 both were verified 2026-11-03.
 
-The fallback leg inherits the tailnet ACL caveat below: with the default
-`action: "check"` it works until the grant lapses, then wants a browser
-re-auth. Setting that rule to `accept` for `autogroup:self` makes the fallback
-fully unattended.
+The fallback leg is fully unattended since the tailnet SSH ACL was set to
+`accept` on 2026-11-03. Verified the same day with `BatchMode=yes`: a plain
+command, a `-L` port forward (HTTP 302 from the Unraid web UI) and the Herdr leg
+itself all ran without a prompt.
 
 ## Why the LAN address is the primary and not the Tailscale IP
 
 `--via` requires a transport that passes bytes untouched and **asks nothing**.
-Tailscale SSH on `100.100.208.69` sits behind the default tailnet ACL
-`action: "check"`, which demands browser re-authentication each period — fine
-interactively, fatal for a long-lived Herdr connection.
+When this was set up, Tailscale SSH sat behind the default tailnet ACL
+`action: "check"`, which demanded browser re-authentication every ~12 h — fine
+interactively, fatal for a long-lived Herdr connection. That ACL was changed to
+`accept` on 2026-11-03, so either address would now serve.
 
-Key auth on `192.168.10.20:422` asks nothing, and from outside the LAN it still
-travels over Tailscale via the MikroTik subnet router (see
-`docs/09-TAILSCALE-VPN.md`). Changing that ACL rule to `accept` for
-`autogroup:self` would make the `100.x` address usable here too.
+The LAN address stays primary anyway: key auth on `192.168.10.20:422` depends on
+nothing but the SSH key, while Tailscale SSH depends on the tailnet policy
+staying permissive. From outside the LAN it still travels over Tailscale via the
+MikroTik subnet router (see `docs/09-TAILSCALE-VPN.md`), so there is no loss.
 
 ## Reboot persistence