hscontrol/servertest: add policy, route, ephemeral, and content tests

Extend the servertest harness with:
- TestClient.Direct() accessor for advanced operations
- TestClient.WaitForPeerCount and WaitForCondition helpers
- TestHarness.ChangePolicy for ACL policy testing
- AssertDERPMapPresent and AssertSelfHasAddresses

New test suites:
- content_test.go: self node, DERP map, peer properties, user profiles,
  update history monotonicity, and endpoint update propagation
- policy_test.go: default allow-all, explicit policy, policy triggers
  updates on all nodes, multiple policy changes, multi-user mesh
- ephemeral_test.go: ephemeral connect, cleanup after disconnect,
  mixed ephemeral/regular, reconnect prevents cleanup
- routes_test.go: addresses in AllowedIPs, route advertise and approve,
  advertised routes via hostinfo, CGNAT range validation

Also fix node_departs test to use WaitForCondition instead of
assert.Eventually, and convert concurrent_join_and_leave to
interleaved_join_and_leave with grace-period-tolerant assertions.

hscontrol/servertest/harness.go

@@ -152,6 +152,31 @@ func (h *TestHarness) WaitForConvergence(tb testing.TB, timeout time.Duration) {
 	h.WaitForMeshComplete(tb, timeout)
 }
 
+// ChangePolicy sets an ACL policy on the server and propagates changes
+// to all connected nodes. The policy should be a valid HuJSON policy document.
+func (h *TestHarness) ChangePolicy(tb testing.TB, policy []byte) {
+	tb.Helper()
+
+	changed, err := h.Server.State().SetPolicy(policy)
+	if err != nil {
+		tb.Fatalf("servertest: ChangePolicy: %v", err)
+	}
+
+	if changed {
+		changes, err := h.Server.State().ReloadPolicy()
+		if err != nil {
+			tb.Fatalf("servertest: ReloadPolicy: %v", err)
+		}
+
+		h.Server.App.Change(changes...)
+	}
+}
+
+// DefaultUser returns the shared user for adding more clients.
+func (h *TestHarness) DefaultUser() *types.User {
+	return h.defaultUser
+}
+
 func clientName(index int) string {
 	return fmt.Sprintf("node-%d", index)
 }