Add docker-tailscale-route: fix Docker losing internet under Tailscale exit-node

Tailscale's exit-node "route all traffic" mode captures Docker's
forwarded container traffic into its tunnel and drops it as an
unrecognized flow, causing every outbound request from inside a
container to hang until timeout. This installs a systemd timer that
keeps an ip rule in place routing Docker's bridge subnet around
Tailscale's catch-all route instead.

Co-Authored-By: Claude Code <noreply@anthropic.com>

docker-tailscale-route.service

@@ -0,0 +1,18 @@
+# Written by an LLM (Claude Code) — review before trusting on a machine
+# other than the one this was diagnosed on. See README.md.
+#
+# Ensures Docker's bridge traffic bypasses Tailscale's exit-node route
+# (see docker-tailscale-route.sh for the full explanation of why this is
+# needed). Triggered on a schedule by the companion
+# docker-tailscale-route.timer unit rather than a network event: on
+# Linux, tailscale0 is a tun device created directly by tailscaled, not
+# through a NetworkManager connection profile, so NetworkManager never
+# fires dispatcher events for it going up/down.
+
+[Unit]
+Description=Ensure Docker bridge traffic bypasses Tailscale's exit-node route
+After=network.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/docker-tailscale-route.sh