Add docker-tailscale-route: fix Docker losing internet under Tailscale exit-node

Tailscale's exit-node "route all traffic" mode captures Docker's
forwarded container traffic into its tunnel and drops it as an
unrecognized flow, causing every outbound request from inside a
container to hang until timeout. This installs a systemd timer that
keeps an ip rule in place routing Docker's bridge subnet around
Tailscale's catch-all route instead.

Co-Authored-By: Claude Code <noreply@anthropic.com>

docker-tailscale-route.timer

@@ -0,0 +1,22 @@
+# Written by an LLM (Claude Code) — review before trusting on a machine
+# other than the one this was diagnosed on. See README.md.
+#
+# Runs docker-tailscale-route.service shortly after boot and then every
+# 15s afterward, so the ip rule that exempts Docker's bridge traffic from
+# Tailscale's exit-node catch-all route gets reinstated quickly after a
+# reboot or a Tailscale reconnect (both can wipe/recreate Tailscale's own
+# ip rules and leave ours missing in the process). Polling is used
+# instead of a network-event hook because NetworkManager doesn't manage
+# the tailscale0 interface and never fires dispatcher/udev events we
+# could reliably hook into for it (confirmed by testing).
+
+[Unit]
+Description=Periodically ensure Docker bridge traffic bypasses Tailscale's exit-node route
+
+[Timer]
+OnBootSec=5s
+OnUnitActiveSec=15s
+Unit=docker-tailscale-route.service
+
+[Install]
+WantedBy=timers.target