OIDC groups implementation

- Add Groups field to User struct with JSON storage
- Include GetGroups() and SetGroups() helper methods
- Extract groups from OIDC claims in FromClaim()
- Add database migration 202509161200 for groups column
- Update config-example.yaml with groups scope
- Add comprehensive documentation and testing

docker-dev/scripts/client-init.sh

@@ -0,0 +1,38 @@
+#!/bin/sh
+# Tailscale client initialization script
+
+CLIENT_NAME=$1
+HEADSCALE_URL="http://headscale:8080"
+
+echo "Initializing Tailscale client: $CLIENT_NAME"
+echo "Headscale server: $HEADSCALE_URL"
+
+# Wait for tailscaled to be ready
+sleep 5
+
+# Check if we have an auth key
+if [ -n "$TS_AUTHKEY" ]; then
+    echo "Using provided auth key to register..."
+    tailscale up \
+        --login-server=$HEADSCALE_URL \
+        --authkey=$TS_AUTHKEY \
+        --hostname=$CLIENT_NAME \
+        --accept-routes
+else
+    echo "No auth key provided. Manual registration required."
+    echo "To register this client:"
+    echo "1. Get the registration URL:"
+    echo "   docker exec $CLIENT_NAME tailscale up --login-server=$HEADSCALE_URL"
+    echo "2. In another terminal, approve the node:"
+    echo "   docker exec headscale-server headscale nodes register --user myuser --key <nodekey>"
+    
+    # Start tailscale in manual mode
+    tailscale up \
+        --login-server=$HEADSCALE_URL \
+        --hostname=$CLIENT_NAME \
+        --accept-routes
+fi
+
+# Keep the container running
+echo "Tailscale client $CLIENT_NAME is running..."
+tail -f /dev/null