Third-Party Access-Path Dependency

After closing port 22, disable Tailscale's 180-day key expiry to avoid server lockout

Putting sshd on a WireGuard tailnet and deleting the public firewall rule is a twenty-minute change. The part worth reviewing is the admin-console toggle that keeps a headless box from logging itself out.