feat: add notnet crate and YubikeySource, thread Tailscale into notstrap

- New crates/notnet: TailscaleOptions, ensure_connected(), auth key chain
  (TS_AUTHKEY env → YubiKey PIV 9d → interactive prompt), install via
  apt/brew/pacman or official install.sh, peer reachability verification
- notsecrets: YubikeySource implementing IdentitySource, reads age key from
  PIV slot 9c; gated behind optional `yubikey` feature
- notstrap: Tailscale step inserted between prerequisites and clone;
  BootstrapOptions.tailscale controls override/skip; NotstrapConfig gains
  optional [tailscale] section; dotfiles_repo is now Option<String> (Tailscale
  gitea_url takes precedence); identity chain adds YubikeySource before
  Bitwarden
- Updated workspace Cargo.toml: notnet added to members and workspace deps
- Integration tests: tailscale: Some(None) to skip Tailscale in all test opts

tests/integration/tests/bootstrap.rs

@@ -69,6 +69,7 @@ fn make_opts(env: &TestEnv, force: bool) -> BootstrapOptions {
         force,
         key_file: Some(env.key_file.clone()),
         dotfiles: Some(env.dotfiles.path().to_path_buf()),
+        tailscale: Some(None), // skip Tailscale in tests
         check_prereqs: None,
         env_injector: None,
     }
@@ -216,6 +217,7 @@ fn test_bootstrap_fails_fast_on_bad_key() {
         force: false,
         key_file: Some(PathBuf::from("/nonexistent/no-such-key.age")),
         dotfiles: Some(d.to_path_buf()),
+        tailscale: Some(None), // skip Tailscale in tests
         check_prereqs: None,
         env_injector: None,
     };