all: apply godoc [Name] link conventions across comments

Every Go-identifier reference in // and /* */ comments now uses
godoc's [Name] linking syntax so pkg.go.dev and `go doc` render
them as clickable cross-references. No behaviour change.

Pattern applied across the tree:
  In-package         [Foo], [Foo.Bar]
  Cross-package      [pkg.Foo], [pkg.Foo.Bar]
  Stdlib             [netip.Prefix], [errors.Is], [context.Context]
  Tailscale          [tailcfg.MapResponse], [tailcfg.Node.CapMap],
                     [tailcfg.NodeAttrSuggestExitNode]

Skip rules:
  - File:line refs left as plain text
  - HuJSON wire keys inside backtick raw strings untouched
  - ACL/policy syntax tokens (tag:foo, autogroup:self, ...) not Go
    symbols, left as plain text
  - JSON/OIDC wire keys, gorm tags, RFC IPv6 placeholders, markdown
    link tags, decorative dividers — all left as-is

integration/dockertestutil/config.go

@@ -22,9 +22,9 @@ func GetIntegrationRunID() string {
 	return os.Getenv("HEADSCALE_INTEGRATION_RUN_ID")
 }
 
-// DockerAddIntegrationLabels adds integration test labels to Docker RunOptions.
+// DockerAddIntegrationLabels adds integration test labels to Docker [dockertest.RunOptions].
 // This allows the hi tool to identify containers belonging to specific test runs.
-// This function should be called before passing RunOptions to dockertest functions.
+// This function should be called before passing [dockertest.RunOptions] to dockertest functions.
 func DockerAddIntegrationLabels(opts *dockertest.RunOptions, testType string) {
 	runID := GetIntegrationRunID()
 	if runID == "" {

integration/dockertestutil/execute.go

@@ -40,7 +40,7 @@ func ExecuteCommandTimeout(timeout time.Duration) ExecuteCommandOption {
 	})
 }
 
-// buffer is a goroutine safe bytes.buffer.
+// buffer is a goroutine safe [bytes.Buffer].
 type buffer struct {
 	store bytes.Buffer
 	mutex sync.Mutex

integration/dockertestutil/network.go

@@ -150,8 +150,9 @@ func DisconnectContainerFromNetwork(
 	return waitContainerRouteAbsent(pool, containerID, network, DockerOpMaxElapsedTime)
 }
 
-// ReconnectContainerToNetwork inverts DisconnectContainerFromNetwork
-// and waits until libnetwork has wired up a fresh IPv4 address.
+// ReconnectContainerToNetwork is the inverse of
+// [DisconnectContainerFromNetwork] — re-attaches the container to the
+// network so traffic can flow again.
 func ReconnectContainerToNetwork(
 	pool *dockertest.Pool,
 	network *dockertest.Network,