Sub-ticket of ONEDB-6 DECISION (Elazar): kpi.pensanta.com exposure - Tailscale-only (team rec: bind whey tailnet IP, no TLS/cert ops, no public attack surface) vs public-TLS · one-db