ACL-gate the gateway to tag:lilbox-vm #35

Epic: #32 — Managed inference gateway — keyless LLM access for boxes

Blocked by: #33

Depends on: #2 (per-box tailnet identity).

Restrict the gateway so only nodes tagged tag:lilbox-vm (from #2) can reach it — tailnet identity becomes the credential, so boxes need no key at all.

Acceptance: a request from an untagged node is refused; a request from a tag:lilbox-vm box succeeds. Requires #2.