fix(agent): always spawn agent with pre-auth key and auto-approve

- Generate a fresh pre-auth key for every agent startup
- Preserve existing tailscale state to avoid creating a new host
- Auto-approve pending auth requests via /api/v1/auth/approve
- Show approval link in settings UI as fallback

Closes HP-558

app/server/headscale/api/resources/auth.ts

@@ -0,0 +1,27 @@
+import type { Capabilities } from "../capabilities";
+import type { Transport } from "../transport";
+
+export interface AuthApi {
+  /**
+   * Approve a pending Headscale authentication request.
+   * Used by the Headplane agent to auto-approve its own registration.
+   */
+  approve(authId: string): Promise<void>;
+}
+
+export function makeAuthApi(
+  transport: Transport,
+  _capabilities: Capabilities,
+  apiKey: string,
+): AuthApi {
+  return {
+    approve: async (authId) => {
+      await transport.request({
+        method: "POST",
+        path: "v1/auth/approve",
+        apiKey,
+        body: { authId },
+      });
+    },
+  };
+}