all: implement PingRequest for node connectivity checking

Implement tailcfg.PingRequest support so the control server can verify
whether a connected node is still reachable. This is the foundation for
faster offline detection (currently ~16min due to Go HTTP/2 TCP retransmit
behavior) and future C2N communication.

The server sends a PingRequest via MapResponse with a unique callback
URL. The Tailscale client responds with a HEAD request to that URL,
proving connectivity. Round-trip latency is measured.

Wire PingRequest through the Change → Batcher → MapResponse pipeline,
add a ping tracker on State for correlating requests with responses,
add ResolveNode for looking up nodes by ID/IP/hostname, and expose a
/debug/ping page (elem-go form UI) and /machine/ping-response endpoint.

Updates #2902
Updates #2129

hscontrol/noise.go

@@ -295,6 +295,26 @@ func (ns *noiseServer) NotImplementedHandler(writer http.ResponseWriter, req *ht
 	http.Error(writer, "Not implemented yet", http.StatusNotImplemented)
 }
 
+// PingResponseHandler handles HEAD requests from clients responding to a
+// PingRequest. The client calls this endpoint to prove connectivity.
+// The unguessable ping ID serves as authentication.
+func (h *Headscale) PingResponseHandler(
+	writer http.ResponseWriter,
+	req *http.Request,
+) {
+	pingID := req.URL.Query().Get("id")
+	if pingID == "" {
+		http.Error(writer, "missing ping ID", http.StatusBadRequest)
+		return
+	}
+
+	if h.state.CompletePing(pingID) {
+		writer.WriteHeader(http.StatusOK)
+	} else {
+		http.Error(writer, "unknown or expired ping", http.StatusNotFound)
+	}
+}
+
 func urlParam[T any](req *http.Request, key string) (T, error) {
 	var zero T