feat: security hardening, production roadmap, admin panel v1

Client security fixes (cmd/tailscale-tray/main.go):
- SSRF protection in Add Server dialog (validateControlURL): reject
  private/loopback/link-local/cloud-metadata IPs via DNS resolution
- RCE gate on AuthURL/BrowseToURL exec paths (validateAuthURL)
- Sanitized URL logging (sanitizeURLForLog drops query auth tokens)
- Error handling on exec.Command with user-facing showError()

Admin panel security (web-admin):
- Bcrypt password hashing (replaces SHA256)
- Rate limiting: 5 failed logins → 15-min lockout
- Session + login attempt cleanup goroutine (hourly)
- url.QueryEscape / encodeURIComponent for all API params
- Fail-hard startup when no TLS and non-loopback bind
- ADMIN_PASSWORD required (no default), password min 12 chars
- Username regex whitelist

Installer hardening (Setup.wxs):
- util:PermissionEx restricts SCM access: only Administrators +
  SYSTEM can start/stop/reconfigure service. Authenticated Users
  limited to QueryStatus/QueryConfig/Interrogate
- Vital="yes" on ServiceInstall

Docs & roadmap:
- PRODUCTION_ROADMAP.md: 5-milestone plan (security + features +
  distribution + ops) with granular tasks, effort, done-when
- CLIENT_SECURITY_AUDIT.md, SECURITY_FIXES.md, DEPLOYMENT.md
- AI assistant rules (.cursorrules, .antigravityrules, etc.)

Build & distribution:
- build-msi.ps1, deploy-and-sign.ps1, sign-release.ps1
- redeploy.ps1, tray-deploy.ps1, test-msi.ps1
- installer/msi/ alternative WXS setup
- Restored .github/workflows/ removed in mirror cleanup

.gitignore hardened: *.pfx, *.p12, *.key, *.pem, .env*

build-msi-log.txt

@@ -0,0 +1,44 @@
+**********************
+Windows PowerShell transcript start
+Start time: 20260421211557
+Username: THINKPAD\huanld
+RunAs User: THINKPAD\huanld
+Configuration Name: 
+Machine: THINKPAD (Microsoft Windows NT 10.0.26200.0)
+Host Application: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe -NoExit -ExecutionPolicy Bypass -File c:\Users\huanld\tailscale\build-msi.ps1
+Process ID: 44876
+PSVersion: 5.1.26100.8115
+PSEdition: Desktop
+PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.26100.8115
+BuildVersion: 10.0.26100.8115
+CLRVersion: 4.0.30319.42000
+WSManStackVersion: 3.0
+PSRemotingProtocolVersion: 2.3
+SerializationVersion: 1.1.0.1
+**********************
+=== 1. CAI DAT WIX TOOLSET (LOCAL VÀ BỎ QUA EULA CỦA V5) ===
+The template "Dotnet local tool manifest file" was created successfully.
+You can invoke the tool from this directory using the following commands: 'dotnet tool run wix' or 'dotnet wix'.
+Tool 'wix' (version '4.0.4') was successfully installed. Entry is added to the manifest file C:\Users\huanld\tailscale\.
+config\dotnet-tools.json.
+
+=== 2. LAY CERTIFICATE DE KY ===
+Dung cert: 896B4F1F63D093D87C3A45239D7D35B31681E8BB
+
+=== 3. KY CAC FILE EXE TRONG \DIST ===
+  tailscaled.exe => Valid
+  tailscale.exe => Valid
+  tailscale-tray.exe => Valid
+
+=== 4. BUILD FILE MSI ===
+
+  Da tao thanh cong file: C:\Users\huanld\tailscale\Tailscale-Custom-Setup.msi
+
+=== 5. KY FILE MSI MOI TAO ===
+  Trang thai ky MSI: Valid
+
+HOAN TAT! BAN CO THE DEM FILE [C:\Users\huanld\tailscale\Tailscale-Custom-Setup.msi] DI CAI DAT.
+**********************
+Windows PowerShell transcript end
+End time: 20260421211630
+**********************