Add docker-tailscale-route: fix Docker losing internet under Tailscale exit-node

Tailscale's exit-node "route all traffic" mode captures Docker's
forwarded container traffic into its tunnel and drops it as an
unrecognized flow, causing every outbound request from inside a
container to hang until timeout. This installs a systemd timer that
keeps an ip rule in place routing Docker's bridge subnet around
Tailscale's catch-all route instead.

Co-Authored-By: Claude Code <noreply@anthropic.com>

uninstall.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+#
+# Written by an LLM (Claude Code) — review before trusting on a machine
+# other than the one this was diagnosed on. See README.md.
+#
+# Removes everything install.sh set up: the timer, service, script,
+# optional config override, and the ip rule itself.
+#
+# Usage: sudo ./uninstall.sh
+
+set -euo pipefail
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo "Must be run as root (sudo ./uninstall.sh)" >&2
+    exit 1
+fi
+
+systemctl disable --now docker-tailscale-route.timer 2>/dev/null || true
+
+rm -f /etc/systemd/system/docker-tailscale-route.timer
+rm -f /etc/systemd/system/docker-tailscale-route.service
+rm -f /usr/local/sbin/docker-tailscale-route.sh
+rm -f /etc/default/docker-tailscale-route
+
+systemctl daemon-reload
+
+DOCKER_SUBNET="172.16.0.0/12"
+TARGET_TABLE="main"
+if ip rule list | grep -q "from ${DOCKER_SUBNET} lookup ${TARGET_TABLE}"; then
+    ip rule del from "$DOCKER_SUBNET" lookup "$TARGET_TABLE"
+fi
+
+echo "Uninstalled."