[management, client, proxy] add expose NetBird-only services over tunnel peers (#6226)

Adds a new "private" service mode for the reverse proxy: services reachable exclusively over the embedded WireGuard tunnel, gated by per-peer group membership instead of operator auth schemes.

Wire contract
- ProxyMapping.private (field 13): the proxy MUST call ValidateTunnelPeer and fail closed; operator schemes are bypassed.
- ProxyCapabilities.private (4) + supports_private_service (5): capability gate. Management never streams private mappings to proxies that don't claim the capability; the broadcast path applies the same filter via filterMappingsForProxy.
- ValidateTunnelPeer RPC: resolves an inbound tunnel IP to a peer, checks the peer's groups against service.AccessGroups, and mints a session JWT on success. checkPeerGroupAccess fails closed when a private service has empty AccessGroups.
- ValidateSession/ValidateTunnelPeer responses now carry peer_group_ids + peer_group_names so the proxy can authorise policy-aware middlewares without an extra management round-trip.
- ProxyInboundListener + SendStatusUpdate.inbound_listener: per-account inbound listener state surfaced to dashboards.
- PathTargetOptions.direct_upstream (11): bypass the embedded NetBird client and dial the target via the proxy host's network stack for upstreams reachable without WireGuard.

Data model
- Service.Private (bool) + Service.AccessGroups ([]string, JSON- serialised). Validate() rejects bearer auth on private services. Copy() deep-copies AccessGroups. pgx getServices loads the columns.
- DomainConfig.Private threaded into the proxy auth middleware. Request handler routes private services through forwardWithTunnelPeer and returns 403 on validation failure.
- Account-level SynthesizePrivateServiceZones (synthetic DNS) and injectPrivateServicePolicies (synthetic ACL) gate on len(svc.AccessGroups) > 0.

Proxy
- /netbird proxy --private (embedded mode) flag; Config.Private in proxy/lifecycle.go.
- Per-account inbound listener (proxy/inbound.go) binding HTTP/HTTPS on the embedded NetBird client's WireGuard tunnel netstack.
- proxy/internal/auth/tunnel_cache: ValidateTunnelPeer response cache with single-flight de-duplication and per-account eviction.
- Local peerstore short-circuit: when the inbound IP isn't in the account roster, deny fast without an RPC.
- proxy/server.go reports SupportsPrivateService=true and redacts the full ProxyMapping JSON from info logs (auth_token + header-auth hashed values now only at debug level).

Identity forwarding
- ValidateSessionJWT returns user_id, email, method, groups, group_names. sessionkey.Claims carries Email + Groups + GroupNames so the proxy can stamp identity onto upstream requests without an extra management round-trip on every cookie-bearing request.
- CapturedData carries userEmail / userGroups / userGroupNames; the proxy stamps X-NetBird-User and X-NetBird-Groups on r.Out from the authenticated identity (strips client-supplied values first to prevent spoofing).
- AccessLog.UserGroups: access-log enrichment captures the user's group memberships at write time so the dashboard can render group context without reverse-resolving stale memberships.

OpenAPI/dashboard surface
- ReverseProxyService gains private + access_groups; ReverseProxyCluster gains private + supports_private. ReverseProxyTarget target_type enum gains "cluster". ServiceTargetOptions gains direct_upstream. ProxyAccessLog gains user_groups.

proxy/internal/tcp/snipeek_test.go

@@ -29,10 +29,11 @@ func TestPeekClientHello_ValidSNI(t *testing.T) {
 		_ = tlsConn.Handshake()
 	}()
 
-	sni, wrapped, err := PeekClientHello(serverConn)
+	sni, wrapped, isTLS, err := PeekClientHello(serverConn)
 	require.NoError(t, err)
 	assert.Equal(t, expectedSNI, sni, "should extract SNI from ClientHello")
 	assert.NotNil(t, wrapped, "wrapped connection should not be nil")
+	assert.True(t, isTLS, "TLS ClientHello should be flagged as TLS")
 
 	// Verify the wrapped connection replays the peeked bytes.
 	// Read the first 5 bytes (TLS record header) to confirm replay.
@@ -83,10 +84,11 @@ func TestPeekClientHello_MultipleSNIs(t *testing.T) {
 				_ = tlsConn.Handshake()
 			}()
 
-			sni, wrapped, err := PeekClientHello(serverConn)
+			sni, wrapped, isTLS, err := PeekClientHello(serverConn)
 			require.NoError(t, err)
 			assert.Equal(t, tt.expectedSNI, sni)
 			assert.NotNil(t, wrapped)
+			assert.True(t, isTLS, "TLS handshake should be flagged as TLS")
 		})
 	}
 }
@@ -102,10 +104,11 @@ func TestPeekClientHello_NonTLSData(t *testing.T) {
 		_, _ = clientConn.Write(httpData)
 	}()
 
-	sni, wrapped, err := PeekClientHello(serverConn)
+	sni, wrapped, isTLS, err := PeekClientHello(serverConn)
 	require.NoError(t, err)
 	assert.Empty(t, sni, "should return empty SNI for non-TLS data")
 	assert.NotNil(t, wrapped)
+	assert.False(t, isTLS, "plain HTTP data should not be flagged as TLS")
 
 	// Verify the wrapped connection still provides the original data.
 	buf := make([]byte, len(httpData))
@@ -124,7 +127,7 @@ func TestPeekClientHello_TruncatedHeader(t *testing.T) {
 		clientConn.Close()
 	}()
 
-	_, _, err := PeekClientHello(serverConn)
+	_, _, _, err := PeekClientHello(serverConn)
 	assert.Error(t, err, "should error on truncated header")
 }
 
@@ -140,7 +143,7 @@ func TestPeekClientHello_TruncatedPayload(t *testing.T) {
 		clientConn.Close()
 	}()
 
-	_, _, err := PeekClientHello(serverConn)
+	_, _, _, err := PeekClientHello(serverConn)
 	assert.Error(t, err, "should error on truncated payload")
 }
 
@@ -154,10 +157,11 @@ func TestPeekClientHello_ZeroLengthRecord(t *testing.T) {
 		_, _ = clientConn.Write([]byte{0x16, 0x03, 0x01, 0x00, 0x00})
 	}()
 
-	sni, wrapped, err := PeekClientHello(serverConn)
+	sni, wrapped, isTLS, err := PeekClientHello(serverConn)
 	require.NoError(t, err)
 	assert.Empty(t, sni)
 	assert.NotNil(t, wrapped)
+	assert.True(t, isTLS, "zero-length record should still be a TLS handshake byte")
 }
 
 func TestExtractSNI_InvalidPayload(t *testing.T) {