#3919 @swamp/cve/tailworm: opt-in reachability matrix from each node's packet filter

The tailworm report says what each host exposes (Tailscale SSH, serve forwards to tailscaled.sock, app connector) and recommends rewriting the SSH policy as per-pair grants, but it cannot show who can actually reach a host, so a user cannot check that the rewrite shrank the blast radius.

Every node already receives its compiled inbound rules from control: the PacketFilter in tailscale debug netmap (source IPs/CIDRs and destination ports allowed to this node), next to the SSHPolicy the probe already reads. The probe deliberately prints only SSHPolicy today.

Proposal:

• New opt-in input (includeReachability, default false) on scan and scanFleet. When on, the probe also prints the PacketFilter key of the netmap and the node's own Tailscale IPs.
• The model stores, per host, the inbound rules: sources and ports, flagging wildcard sources (the default allow-all) and ports that matter for Tailworm (22 with Tailscale SSH, serve ports forwarding to localapi).
• The report renders an inbound reachability section per host, and in scanFleet a matrix between scanned hosts (source host to destination host: allowed ports or denied), naming sources by the fleet's own Tailscale IPs and leaving unscanned sources as IPs/CIDRs.
• Labelled as compiled policy, not a live test. No connections to peers; peer list still not collected.

Inspired by a reachability check posted after a tag-based policy rollout (gist.github.com/alexknowshtml/515c5e741dc4c157d2293f782d15ed41).