fix: bundle Tailscale ARM binaries + fix execute bits in SPK

- Bundled tailscale 1.98.9 + tailscaled ARMv7 (ELF 32-bit, statically linked)
- Fixed connect-daemon.sh 644 → 755 (was preventing daemon from starting)
- Postinst now chmod +x all bin/*.sh and bundled binaries
- Postinst copies tailscale/tailscaled to /usr/local/bin if not present
- Hub firewall: opened ports 8080 (API) and 2230-2299 (SSH tunnels)
- Hub systemd service restarted after firewall fix

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

kit-connect/scripts/postinst

@@ -9,11 +9,21 @@ log() { logger -t "$LOG_TAG" -p local0.warn "$*"; }
 
 mkdir -p /etc/kit-connect /etc/busrouter "$PKG_DIR/var"
 
-# Make scripts and wizard executable
+# ── Fix permissions (synopkg doesn't preserve +x from tar) ──────
+chmod +x "$PKG_DIR/bin/"*.sh 2>/dev/null || true
+chmod +x "$PKG_DIR/bin/tailscale" "$PKG_DIR/bin/tailscaled" 2>/dev/null || true
 chmod +x "$PKG_DIR/wizard.sh" 2>/dev/null || true
-chmod +x "$PKG_DIR/bin/serve-dashboard.sh" 2>/dev/null || true
 chmod 600 "$PKG_DIR/bin/connect_id_ed25519" 2>/dev/null || true
 
+# ── Install bundled Tailscale binaries if system doesn't have them ──
+if [ ! -f /usr/local/bin/tailscale ] && [ -f "$PKG_DIR/bin/tailscale" ]; then
+	log "Installing bundled Tailscale binaries..."
+	cp "$PKG_DIR/bin/tailscale" /usr/local/bin/tailscale
+	cp "$PKG_DIR/bin/tailscaled" /usr/local/bin/tailscaled
+	chmod +x /usr/local/bin/tailscale /usr/local/bin/tailscaled
+	log "Tailscale binaries installed to /usr/local/bin"
+fi
+
 # Run the Keylink IT setup wizard (non-interactive)
 # This detects device ID, writes config, registers with hub, starts Tailscale.
 if [ -x "$PKG_DIR/wizard.sh" ]; then