Add gateway.devices.autoApprove config option to auto-approve device
pairing when requests come via Tailscale Serve with verified identity.
- Add "none" (default) and "tailscale" modes for autoApprove policy
- Auto-approve devices when Tailscale auth succeeds (verified via whois)
- Add autoApproved/autoApproveReason fields to device.pair.resolved event
- Add security audit info finding when tailscale mode is enabled
- Add comprehensive tests for config validation and auto-approve logic
- Add documentation in gateway configuration guide
Fixes#3795
64bcb16ba3