tailcat: tailcat: Use WireGuard tunnels like netcat without a Tailscale account

Extracts only the data plane from Tailscale to establish Point-to-Point WireGuard tunnels without requiring an account or root privileges. It connects two devices behind NAT firewalls, exchanging connection metadata out-of-band via DERP servers. Unlike traditional Tailscale, it does not rely on the Control Plane, operating in user space without modifying routing tables or DNS settings.

When the server starts, it issues a short connection token; once the client enters it, communication begins immediately. It supports tunneling standard input/output streams like netcat, local port forwarding, SOCKS5 proxying, and acting as an Exit Node. In particular, the `tailcat ssh` command allows opening unauthenticated SSH sessions over an authenticated WireGuard tunnel, eliminating the need for firewall port opening or port knocking configuration.

Connection tokens can be registered as DNS TXT records and called by domain name, enabling stable access even in dynamic IP environments. By default, it uses ephemeral keys that expire after each run, but using a fixed key saved with `genkey` allows connecting to the same address after restarts. If NAT traversal fails, the WireGuard tunnel maintains a fallback connection through Tailscale's DERP servers, minimizing network environment constraints.