all: apply godoc [Name] link conventions across comments

Every Go-identifier reference in // and /* */ comments now uses
godoc's [Name] linking syntax so pkg.go.dev and `go doc` render
them as clickable cross-references. No behaviour change.

Pattern applied across the tree:
  In-package         [Foo], [Foo.Bar]
  Cross-package      [pkg.Foo], [pkg.Foo.Bar]
  Stdlib             [netip.Prefix], [errors.Is], [context.Context]
  Tailscale          [tailcfg.MapResponse], [tailcfg.Node.CapMap],
                     [tailcfg.NodeAttrSuggestExitNode]

Skip rules:
  - File:line refs left as plain text
  - HuJSON wire keys inside backtick raw strings untouched
  - ACL/policy syntax tokens (tag:foo, autogroup:self, ...) not Go
    symbols, left as plain text
  - JSON/OIDC wire keys, gorm tags, RFC IPv6 placeholders, markdown
    link tags, decorative dividers — all left as-is

hscontrol/util/zlog/fields.go

@@ -1,8 +1,8 @@
 // Package zlog provides zerolog utilities for safe and consistent logging.
 //
 // This package contains:
-//   - Safe wrapper types for external types (tailcfg.Hostinfo, tailcfg.MapRequest)
-//     that implement LogObjectMarshaler with security-conscious field redaction
+//   - Safe wrapper types for external types ([tailcfg.Hostinfo], [tailcfg.MapRequest])
+//     that implement [zerolog.LogObjectMarshaler] with security-conscious field redaction
 //
 // For field name constants, use the zf subpackage:
 //

hscontrol/util/zlog/hostinfo.go

@@ -6,7 +6,7 @@ import (
 	"tailscale.com/tailcfg"
 )
 
-// SafeHostinfo wraps tailcfg.Hostinfo for safe logging.
+// SafeHostinfo wraps [tailcfg.Hostinfo] for safe logging.
 //
 // SECURITY: This wrapper intentionally redacts device fingerprinting data
 // that could be used to identify or track specific devices:
@@ -24,12 +24,12 @@ type SafeHostinfo struct {
 	hi *tailcfg.Hostinfo
 }
 
-// Hostinfo creates a SafeHostinfo wrapper for safe logging.
+// Hostinfo creates a [SafeHostinfo] wrapper for safe logging.
 func Hostinfo(hi *tailcfg.Hostinfo) SafeHostinfo {
 	return SafeHostinfo{hi: hi}
 }
 
-// MarshalZerologObject implements zerolog.LogObjectMarshaler.
+// MarshalZerologObject implements [zerolog.LogObjectMarshaler].
 func (s SafeHostinfo) MarshalZerologObject(e *zerolog.Event) {
 	if s.hi == nil {
 		return

hscontrol/util/zlog/init_test.go

@@ -2,9 +2,9 @@ package zlog
 
 import "github.com/rs/zerolog"
 
-// init pins zerolog to TraceLevel for the zlog test binary.
+// init pins zerolog to [zerolog.TraceLevel] for the zlog test binary.
 //
-// zlog's tests use zerolog.New(&buf) and assert on Info-level output. zerolog's
+// zlog's tests use [zerolog.New] with a buffer and assert on Info-level output. zerolog's
 // (*Logger).should() gates emission on the global level, so any global level
 // above Info would silently break the assertions.
 //

hscontrol/util/zlog/maprequest.go

@@ -6,11 +6,11 @@ import (
 	"tailscale.com/tailcfg"
 )
 
-// SafeMapRequest wraps tailcfg.MapRequest for safe logging.
+// SafeMapRequest wraps [tailcfg.MapRequest] for safe logging.
 //
 // SECURITY: This wrapper does not log sensitive information:
 //   - Endpoints: Client IP addresses and ports
-//   - Hostinfo: Device fingerprinting data (handled by SafeHostinfo)
+//   - Hostinfo: Device fingerprinting data (handled by [SafeHostinfo])
 //   - DERPForceWebsockets: Network configuration details
 //
 // Only safe fields are logged:
@@ -23,12 +23,12 @@ type SafeMapRequest struct {
 	req *tailcfg.MapRequest
 }
 
-// MapRequest creates a SafeMapRequest wrapper for safe logging.
+// MapRequest creates a [SafeMapRequest] wrapper for safe logging.
 func MapRequest(req *tailcfg.MapRequest) SafeMapRequest {
 	return SafeMapRequest{req: req}
 }
 
-// MarshalZerologObject implements zerolog.LogObjectMarshaler.
+// MarshalZerologObject implements [zerolog.LogObjectMarshaler].
 func (s SafeMapRequest) MarshalZerologObject(e *zerolog.Event) {
 	if s.req == nil {
 		return
@@ -46,6 +46,6 @@ func (s SafeMapRequest) MarshalZerologObject(e *zerolog.Event) {
 
 	// SECURITY: The following fields are intentionally NOT logged:
 	// - Endpoints: Client IP addresses and ports
-	// - Hostinfo: Device fingerprinting data (use SafeHostinfo separately if needed)
+	// - Hostinfo: Device fingerprinting data (use [SafeHostinfo] separately if needed)
 	// - DERPForceWebsockets: Network configuration details
 }