all: apply godoc [Name] link conventions across comments

Every Go-identifier reference in // and /* */ comments now uses
godoc's [Name] linking syntax so pkg.go.dev and `go doc` render
them as clickable cross-references. No behaviour change.

Pattern applied across the tree:
  In-package         [Foo], [Foo.Bar]
  Cross-package      [pkg.Foo], [pkg.Foo.Bar]
  Stdlib             [netip.Prefix], [errors.Is], [context.Context]
  Tailscale          [tailcfg.MapResponse], [tailcfg.Node.CapMap],
                     [tailcfg.NodeAttrSuggestExitNode]

Skip rules:
  - File:line refs left as plain text
  - HuJSON wire keys inside backtick raw strings untouched
  - ACL/policy syntax tokens (tag:foo, autogroup:self, ...) not Go
    symbols, left as plain text
  - JSON/OIDC wire keys, gorm tags, RFC IPv6 placeholders, markdown
    link tags, decorative dividers — all left as-is

hscontrol/policy/policy.go

@@ -51,6 +51,11 @@ func ReduceRoutes(
 }
 
 // BuildPeerMap builds a map of all peers that can be accessed by each node.
+//
+// Compared to [ReduceNodes], which builds the list per node, we end up with
+// doing the full work for every node (O(n^2)), while this will reduce the
+// list as we see relationships while building the map, making it O(n^2/2)
+// in the end, but with less work per node.
 func BuildPeerMap(
 	nodes views.Slice[types.NodeView],
 	matchers []matcher.Match,
@@ -58,9 +63,6 @@ func BuildPeerMap(
 	ret := make(map[types.NodeID][]types.NodeView, nodes.Len())
 
 	// Build the map of all peers according to the matchers.
-	// Compared to ReduceNodes, which builds the list per node, we end up with doing
-	// the full work for every node (On^2), while this will reduce the list as we see
-	// relationships while building the map, making it O(n^2/2) in the end, but with less work per node.
 	for i := range nodes.Len() {
 		for j := i + 1; j < nodes.Len(); j++ {
 			if nodes.At(i).ID() == nodes.At(j).ID() {
@@ -78,7 +80,8 @@ func BuildPeerMap(
 }
 
 // ApproveRoutesWithPolicy checks if the node can approve the announced routes
-// and returns the new list of approved routes.
+// and returns the new list of approved routes. The [PolicyManager] is consulted
+// via [PolicyManager.NodeCanApproveRoute].
 // The approved routes will include:
 // 1. ALL previously approved routes (regardless of whether they're still advertised)
 // 2. New routes from announcedRoutes that can be auto-approved by policy