tailscale: add service + Trayscale, enable on host

Tailscale with --operator=zephrynis so the daemon is drivable without
sudo (Trayscale + tailscale switch/login from a plain shell), plus the
Trayscale systray app. Imported into the nixos-pc host.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

hosts/nixos-pc/default.nix

@@ -7,6 +7,7 @@
     ../../modules/desktop.nix
     ../../modules/nvidia.nix
     ../../modules/gaming.nix
+    ../../modules/tailscale.nix
   ];
 
   networking.hostName = "nixos-pc";

modules/tailscale.nix

@@ -0,0 +1,15 @@
+{ pkgs, ... }:
+
+{
+  services.tailscale = {
+    enable = true;
+    # Let zephrynis drive the daemon without sudo — required for Trayscale,
+    # and makes `tailscale switch` / `login` work from a plain shell too
+    extraSetFlags = [ "--operator=zephrynis" ];
+  };
+
+  # Tray app for the bar's systray: status toggle + account switcher
+  # (work/personal via Tailscale fast user switching). Autostarted from
+  # hypr/custom/execs.lua (appended in home/zephrynis.nix).
+  environment.systemPackages = [ pkgs.trayscale ];
+}