refactor(tailscale): rename exit-node to subnet-router; drop --advertise-exit-node

The host was always intended as a LAN subnet router (--advertise-routes),
not a full exit node (--advertise-exit-node). Rename every trace of
"exit-node" to "subnet-router" and remove the --advertise-exit-node flag
from extraSetFlags; the operator supplies --advertise-routes at first
tailscale up and Tailscale persists it in state across reboots.

Routing sysctls (useRoutingFeatures = "server"), openFirewall, and
trustedInterfaces = ["tailscale0"] are still required for subnet routing
to work, so the module is kept — just correctly named.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TF2dsuKZAiyZWQ1D7CuHJm

modules/build-types/tailscale-exit-node.nix

@@ -1,21 +0,0 @@
-{ ... }:
-
-{
-  imports = [
-    ../tailscale/exit-node.nix
-  ];
-
-  # "server", not "both": this build type only ever advertises itself as an
-  # exit node (see ../tailscale/exit-node.nix) -- it doesn't advertise LAN
-  # subnet routes, so it doesn't need the "client"-side loose reverse-path
-  # filtering that "both" would also turn on. Deliberately left unbundled
-  # from LAN-subnet-route advertisement so this build type stays valid on
-  # every platform, including linode (a remote VPS with no network path to
-  # the home LAN at all).
-  services.tailscale.useRoutingFeatures = "server";
-
-  # Forwarded exit-node traffic arrives on tailscale0 already
-  # tailscale-authenticated -- the firewall's normal per-port allow-list
-  # would otherwise drop it. Standard NixOS/Tailscale exit-node guidance.
-  networking.firewall.trustedInterfaces = [ "tailscale0" ];
-}

modules/build-types/tailscale-subnet-router.nix

@@ -0,0 +1,19 @@
+{ ... }:
+
+{
+  imports = [
+    ../tailscale/subnet-router.nix
+  ];
+
+  # "server", not "both": this build type advertises LAN subnet routes but
+  # doesn't use another tailscale exit node itself, so it doesn't need the
+  # "client"-side loose reverse-path filtering that "both" would also enable.
+  # Deliberately kept explicit here (not just relying on subnet-router.nix's
+  # own setting) so the intent is clear at the build-type level.
+  services.tailscale.useRoutingFeatures = "server";
+
+  # Forwarded subnet-router traffic arrives on tailscale0 already
+  # tailscale-authenticated -- the firewall's normal per-port allow-list
+  # would otherwise drop it. Standard NixOS/Tailscale subnet-router guidance.
+  networking.firewall.trustedInterfaces = [ "tailscale0" ];
+}