hscontrol/servertest: add policy, route, ephemeral, and content tests

Extend the servertest harness with:
- TestClient.Direct() accessor for advanced operations
- TestClient.WaitForPeerCount and WaitForCondition helpers
- TestHarness.ChangePolicy for ACL policy testing
- AssertDERPMapPresent and AssertSelfHasAddresses

New test suites:
- content_test.go: self node, DERP map, peer properties, user profiles,
  update history monotonicity, and endpoint update propagation
- policy_test.go: default allow-all, explicit policy, policy triggers
  updates on all nodes, multiple policy changes, multi-user mesh
- ephemeral_test.go: ephemeral connect, cleanup after disconnect,
  mixed ephemeral/regular, reconnect prevents cleanup
- routes_test.go: addresses in AllowedIPs, route advertise and approve,
  advertised routes via hostinfo, CGNAT range validation

Also fix node_departs test to use WaitForCondition instead of
assert.Eventually, and convert concurrent_join_and_leave to
interleaved_join_and_leave with grace-period-tolerant assertions.

hscontrol/servertest/assertions.go

@@ -167,6 +167,50 @@ func AssertConsistentState(tb testing.TB, clients []*TestClient) {
 	}
 }
 
+// AssertDERPMapPresent checks that the netmap contains a DERP map.
+func AssertDERPMapPresent(tb testing.TB, client *TestClient) {
+	tb.Helper()
+
+	nm := client.Netmap()
+	if nm == nil {
+		tb.Errorf("AssertDERPMapPresent: %s has no netmap", client.Name)
+
+		return
+	}
+
+	if nm.DERPMap == nil {
+		tb.Errorf("AssertDERPMapPresent: %s has nil DERPMap", client.Name)
+
+		return
+	}
+
+	if len(nm.DERPMap.Regions) == 0 {
+		tb.Errorf("AssertDERPMapPresent: %s has empty DERPMap regions", client.Name)
+	}
+}
+
+// AssertSelfHasAddresses checks that the self node has at least one address.
+func AssertSelfHasAddresses(tb testing.TB, client *TestClient) {
+	tb.Helper()
+
+	nm := client.Netmap()
+	if nm == nil {
+		tb.Errorf("AssertSelfHasAddresses: %s has no netmap", client.Name)
+
+		return
+	}
+
+	if !nm.SelfNode.Valid() {
+		tb.Errorf("AssertSelfHasAddresses: %s self node is invalid", client.Name)
+
+		return
+	}
+
+	if nm.SelfNode.Addresses().Len() == 0 {
+		tb.Errorf("AssertSelfHasAddresses: %s self node has no addresses", client.Name)
+	}
+}
+
 // EventuallyAssertMeshComplete retries AssertMeshComplete up to
 // timeout, useful when waiting for state to propagate.
 func EventuallyAssertMeshComplete(tb testing.TB, clients []*TestClient, timeout time.Duration) {