[management, client, proxy] add expose NetBird-only services over tunnel peers (#6226)

Adds a new "private" service mode for the reverse proxy: services reachable exclusively over the embedded WireGuard tunnel, gated by per-peer group membership instead of operator auth schemes.

Wire contract
- ProxyMapping.private (field 13): the proxy MUST call ValidateTunnelPeer and fail closed; operator schemes are bypassed.
- ProxyCapabilities.private (4) + supports_private_service (5): capability gate. Management never streams private mappings to proxies that don't claim the capability; the broadcast path applies the same filter via filterMappingsForProxy.
- ValidateTunnelPeer RPC: resolves an inbound tunnel IP to a peer, checks the peer's groups against service.AccessGroups, and mints a session JWT on success. checkPeerGroupAccess fails closed when a private service has empty AccessGroups.
- ValidateSession/ValidateTunnelPeer responses now carry peer_group_ids + peer_group_names so the proxy can authorise policy-aware middlewares without an extra management round-trip.
- ProxyInboundListener + SendStatusUpdate.inbound_listener: per-account inbound listener state surfaced to dashboards.
- PathTargetOptions.direct_upstream (11): bypass the embedded NetBird client and dial the target via the proxy host's network stack for upstreams reachable without WireGuard.

Data model
- Service.Private (bool) + Service.AccessGroups ([]string, JSON- serialised). Validate() rejects bearer auth on private services. Copy() deep-copies AccessGroups. pgx getServices loads the columns.
- DomainConfig.Private threaded into the proxy auth middleware. Request handler routes private services through forwardWithTunnelPeer and returns 403 on validation failure.
- Account-level SynthesizePrivateServiceZones (synthetic DNS) and injectPrivateServicePolicies (synthetic ACL) gate on len(svc.AccessGroups) > 0.

Proxy
- /netbird proxy --private (embedded mode) flag; Config.Private in proxy/lifecycle.go.
- Per-account inbound listener (proxy/inbound.go) binding HTTP/HTTPS on the embedded NetBird client's WireGuard tunnel netstack.
- proxy/internal/auth/tunnel_cache: ValidateTunnelPeer response cache with single-flight de-duplication and per-account eviction.
- Local peerstore short-circuit: when the inbound IP isn't in the account roster, deny fast without an RPC.
- proxy/server.go reports SupportsPrivateService=true and redacts the full ProxyMapping JSON from info logs (auth_token + header-auth hashed values now only at debug level).

Identity forwarding
- ValidateSessionJWT returns user_id, email, method, groups, group_names. sessionkey.Claims carries Email + Groups + GroupNames so the proxy can stamp identity onto upstream requests without an extra management round-trip on every cookie-bearing request.
- CapturedData carries userEmail / userGroups / userGroupNames; the proxy stamps X-NetBird-User and X-NetBird-Groups on r.Out from the authenticated identity (strips client-supplied values first to prevent spoofing).
- AccessLog.UserGroups: access-log enrichment captures the user's group memberships at write time so the dashboard can render group context without reverse-resolving stale memberships.

OpenAPI/dashboard surface
- ReverseProxyService gains private + access_groups; ReverseProxyCluster gains private + supports_private. ReverseProxyTarget target_type enum gains "cluster". ServiceTargetOptions gains direct_upstream. ProxyAccessLog gains user_groups.

shared/management/client/rest/reverse_proxy_services_test.go

@@ -116,8 +116,8 @@ func TestReverseProxyServices_Create_200(t *testing.T) {
 			Name:    "test-service",
 			Domain:  "test.example.com",
 			Enabled: true,
-			Auth:    api.ServiceAuthConfig{},
-			Targets: []api.ServiceTarget{testServiceTarget},
+			Auth:    &api.ServiceAuthConfig{},
+			Targets: &[]api.ServiceTarget{testServiceTarget},
 		})
 		require.NoError(t, err)
 		assert.Equal(t, testService.Id, ret.Id)
@@ -136,8 +136,8 @@ func TestReverseProxyServices_Create_Err(t *testing.T) {
 			Name:    "test-service",
 			Domain:  "test.example.com",
 			Enabled: true,
-			Auth:    api.ServiceAuthConfig{},
-			Targets: []api.ServiceTarget{testServiceTarget},
+			Auth:    &api.ServiceAuthConfig{},
+			Targets: &[]api.ServiceTarget{testServiceTarget},
 		})
 		assert.Error(t, err)
 		assert.Equal(t, "No", err.Error())
@@ -154,8 +154,9 @@ func TestReverseProxyServices_Create_WithPerTargetOptions(t *testing.T) {
 			var req api.ServiceRequest
 			require.NoError(t, json.Unmarshal(reqBytes, &req))
 
-			require.Len(t, req.Targets, 1)
-			target := req.Targets[0]
+			require.NotNil(t, req.Targets, "targets must be set on the request")
+			require.Len(t, *req.Targets, 1)
+			target := (*req.Targets)[0]
 			require.NotNil(t, target.Options, "options should be present")
 			opts := target.Options
 			require.NotNil(t, opts.SkipTlsVerify, "skip_tls_verify should be present")
@@ -177,8 +178,8 @@ func TestReverseProxyServices_Create_WithPerTargetOptions(t *testing.T) {
 			Name:    "test-service",
 			Domain:  "test.example.com",
 			Enabled: true,
-			Auth:    api.ServiceAuthConfig{},
-			Targets: []api.ServiceTarget{
+			Auth:    &api.ServiceAuthConfig{},
+			Targets: &[]api.ServiceTarget{
 				{
 					TargetId:   "peer-123",
 					TargetType: "peer",
@@ -216,8 +217,8 @@ func TestReverseProxyServices_Update_200(t *testing.T) {
 			Name:    "updated-service",
 			Domain:  "test.example.com",
 			Enabled: true,
-			Auth:    api.ServiceAuthConfig{},
-			Targets: []api.ServiceTarget{testServiceTarget},
+			Auth:    &api.ServiceAuthConfig{},
+			Targets: &[]api.ServiceTarget{testServiceTarget},
 		})
 		require.NoError(t, err)
 		assert.Equal(t, testService.Id, ret.Id)
@@ -236,8 +237,8 @@ func TestReverseProxyServices_Update_Err(t *testing.T) {
 			Name:    "updated-service",
 			Domain:  "test.example.com",
 			Enabled: true,
-			Auth:    api.ServiceAuthConfig{},
-			Targets: []api.ServiceTarget{testServiceTarget},
+			Auth:    &api.ServiceAuthConfig{},
+			Targets: &[]api.ServiceTarget{testServiceTarget},
 		})
 		assert.Error(t, err)
 		assert.Equal(t, "No", err.Error())