OIDC groups implementation

- Add Groups field to User struct with JSON storage
- Include GetGroups() and SetGroups() helper methods
- Extract groups from OIDC claims in FromClaim()
- Add database migration 202509161200 for groups column
- Update config-example.yaml with groups scope
- Add comprehensive documentation and testing

docker-dev/scripts/client-init.sh

@@ -0,0 +1,38 @@
+#!/bin/sh
+# Tailscale client initialization script
+
+CLIENT_NAME=$1
+HEADSCALE_URL="http://headscale:8080"
+
+echo "Initializing Tailscale client: $CLIENT_NAME"
+echo "Headscale server: $HEADSCALE_URL"
+
+# Wait for tailscaled to be ready
+sleep 5
+
+# Check if we have an auth key
+if [ -n "$TS_AUTHKEY" ]; then
+    echo "Using provided auth key to register..."
+    tailscale up \
+        --login-server=$HEADSCALE_URL \
+        --authkey=$TS_AUTHKEY \
+        --hostname=$CLIENT_NAME \
+        --accept-routes
+else
+    echo "No auth key provided. Manual registration required."
+    echo "To register this client:"
+    echo "1. Get the registration URL:"
+    echo "   docker exec $CLIENT_NAME tailscale up --login-server=$HEADSCALE_URL"
+    echo "2. In another terminal, approve the node:"
+    echo "   docker exec headscale-server headscale nodes register --user myuser --key <nodekey>"
+    
+    # Start tailscale in manual mode
+    tailscale up \
+        --login-server=$HEADSCALE_URL \
+        --hostname=$CLIENT_NAME \
+        --accept-routes
+fi
+
+# Keep the container running
+echo "Tailscale client $CLIENT_NAME is running..."
+tail -f /dev/null

docker-dev/scripts/setup-headscale.sh

@@ -0,0 +1,54 @@
+#!/bin/bash
+# Setup script for Headscale server
+# Creates users and generates pre-auth keys for Tailscale clients
+
+set -e
+
+echo "Waiting for Headscale to be ready..."
+sleep 5
+
+# Create a user for our test environment
+echo "Creating user 'testuser'..."
+docker exec headscale-server headscale users create testuser || echo "User might already exist"
+
+# Get the user ID (newer Headscale versions require user ID instead of username)
+echo "Getting user ID..."
+USER_ID=$(docker exec headscale-server headscale --output json users list | jq -r '.[] | select(.username=="testuser") | .id' 2>/dev/null)
+
+if [ -z "$USER_ID" ]; then
+    echo "Failed to get user ID. Trying alternative method..."
+    USER_ID=1  # Default to 1 for first user
+fi
+
+echo "Using user ID: $USER_ID"
+
+# Generate pre-auth keys for the clients using user ID
+echo "Generating pre-auth keys..."
+KEY1=$(docker exec headscale-server headscale --output json preauthkeys create --user $USER_ID --reusable --expiration 24h | jq -r '.key' 2>/dev/null || echo "")
+KEY2=$(docker exec headscale-server headscale --output json preauthkeys create --user $USER_ID --reusable --expiration 24h | jq -r '.key' 2>/dev/null || echo "")
+
+if [ -z "$KEY1" ] || [ -z "$KEY2" ]; then
+    echo "Failed to generate pre-auth keys automatically."
+    echo "You can create them manually with:"
+    echo "  docker exec headscale-server headscale preauthkeys create --user $USER_ID --reusable --expiration 24h"
+    echo ""
+    echo "Then add them to the .env file:"
+    echo "  TS_AUTHKEY_CLIENT1=<key1>"
+    echo "  TS_AUTHKEY_CLIENT2=<key2>"
+else
+    # Save the keys to .env file
+    cat > .env << EOF
+# Headscale pre-auth keys for Tailscale clients
+COMPOSE_PROJECT_NAME=headscale-dev
+TS_AUTHKEY_CLIENT1=$KEY1
+TS_AUTHKEY_CLIENT2=$KEY2
+EOF
+    
+    echo "Pre-auth keys saved to .env file:"
+    echo "  Client1: $KEY1"
+    echo "  Client2: $KEY2"
+fi
+
+echo ""
+echo "Setup complete! You can now restart the clients with:"
+echo "  docker compose restart tailscale-client1 tailscale-client2"