types/config, types/node: model default-auto-update from auto_update.enabled

Tailscale stamps tailcfg.NodeAttrDefaultAutoUpdate on every node's
CapMap with a JSON bool reflecting the tailnet-wide auto-update
default. Headscale grows an auto_update.enabled config option and
emits the cap accordingly from TailNode -- the cap leaves the
unmodelledTailnetStateCaps strip list and is compared in full by the
nodeAttrs compat suite.

testNodeAttrsSuccess drives cfg.AutoUpdate.Enabled from
tf.Input.Tailnet.Settings.DevicesAutoUpdatesOn so each capture's
expected emission matches the SaaS state it was taken under. Two
captures cover both branches:

  - nodeattrs-tailnet-devices-auto-updates-on  -> [true]
  - nodeattrs-tailnet-devices-auto-updates-off -> [false]

The Tailscale v2 TailnetSettings API does not expose the Send Files
toggle, so the compat suite cannot vary cfg.Taildrop.Enabled per
capture. TestTaildropDisabledWithholdsFileSharingCap covers the off
path directly in servertest.

hscontrol/policy/v2/tailnet_state_caps.go

@@ -121,12 +121,6 @@ var unmodelledTailnetStateCaps = []tailcfg.NodeCapability{
 	// with no real-world equivalent.
 	tailcfg.NodeAttrTailnetDisplayName,
 
-	// [tailcfg.NodeAttrDefaultAutoUpdate]: tailnet-wide default for
-	// client auto-update behavior. Headscale has no equivalent
-	// tailnet setting and would emit an invented constant. Skip
-	// until the auto-update default lands as a real config knob.
-	tailcfg.NodeAttrDefaultAutoUpdate,
-
 	// [tailcfg.NodeAttrMaxKeyDuration]: tailnet-wide max key duration
 	// value. Headscale has cfg.Node.Expiry but does not surface it
 	// as a cap today; the hosted control plane emits this only when

hscontrol/policy/v2/tailscale_nodeattrs_compat_test.go

@@ -239,9 +239,20 @@ func testNodeAttrsSuccess(
 	got, err := pol.compileNodeAttrs(users, nodes.ViewSlice())
 	require.NoErrorf(t, err, "%s: compileNodeAttrs", tf.TestID)
 
-	// Mirror the prod self-build: route function is irrelevant for CapMap;
-	// Taildrop.Enabled=true matches the SaaS-captured tailnets.
+	// Mirror the prod self-build: route function is irrelevant for CapMap.
+	//
+	// Taildrop.Enabled defaults to true here because every capture is
+	// taken with the SaaS default Send Files state. The Tailscale v2
+	// TailnetSettings API does not expose the Send Files toggle, so
+	// tscap cannot vary it; the off-path is covered directly by
+	// TestTaildropDisabledWithholdsFileSharingCap in servertest.
+	// TODO: wire Taildrop.Enabled from tf.Input.Tailnet.Settings.FileSharing
+	// once the field is added to the public TailnetSettings API.
 	cfg := &types.Config{Taildrop: types.TaildropConfig{Enabled: true}}
+	if v := tf.Input.Tailnet.Settings.DevicesAutoUpdatesOn; v != nil && *v {
+		cfg.AutoUpdate = types.AutoUpdateConfig{Enabled: true}
+	}
+
 	emptyRoutes := func(types.NodeID) []netip.Prefix { return nil }
 
 	selfCapMap := func(t *testing.T, node *types.Node) tailcfg.NodeCapMap {