Tailnet SSH policy changed from the default action:"check" to accept. The
effective policy is now a single rule covering all tailnet nodes, with no
expiry and port forwarding allowed, so the per-device ~12h grants and the
browser re-auth prompt are gone.
Verified unattended with BatchMode=yes: a plain command, a -L forward
returning HTTP 302, and the Herdr fallback leg.
Records the trade-off: check acted as a second factor, so a compromised
tailnet device now reaches root on Unraid without a further step.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
