fix(auth): treat Tailscale Serve loopback host as remote-reachable

apps/server/src/auth/EnvironmentAuthPolicy.test.ts

@@ -97,6 +97,24 @@ it.layer(NodeServices.layer)("EnvironmentAuthPolicy.layer", (it) => {
     ),
   );
 
+  it.effect("uses remote-reachable policy when Tailscale Serve exposes a loopback host", () =>
+    Effect.gen(function* () {
+      const policy = yield* EnvironmentAuthPolicy.EnvironmentAuthPolicy;
+      const descriptor = yield* policy.getDescriptor();
+
+      expect(descriptor.policy).toBe("remote-reachable");
+      expect(descriptor.bootstrapMethods).toEqual(["one-time-token"]);
+    }).pipe(
+      Effect.provide(
+        makeEnvironmentAuthPolicyLayer({
+          mode: "web",
+          host: "127.0.0.1",
+          tailscaleServeEnabled: true,
+        }),
+      ),
+    ),
+  );
+
   it.effect("uses remote-reachable policy for non-loopback web hosts", () =>
     Effect.gen(function* () {
       const policy = yield* EnvironmentAuthPolicy.EnvironmentAuthPolicy;

apps/server/src/auth/EnvironmentAuthPolicy.ts

@@ -16,7 +16,10 @@ export class EnvironmentAuthPolicy extends Context.Service<
 
 export const make = Effect.gen(function* () {
   const config = yield* ServerConfig.ServerConfig;
-  const isRemoteReachable = isWildcardHost(config.host) || !isLoopbackHost(config.host);
+  // Tailscale Serve proxies the loopback-bound backend onto the tailnet, so the
+  // server is remotely reachable even though config.host stays on 127.0.0.1.
+  const isRemoteReachable =
+    config.tailscaleServeEnabled || isWildcardHost(config.host) || !isLoopbackHost(config.host);
 
   const policy =
     config.mode === "desktop"