Private DSH One Gateway

Key features

• Make DSH itself multi-tenant, or reduce the privileges of an allowlisted user (every allowlisted principal is a full DSH administrator).
• Serve injected exactly one Tailscale-User-Login and the value is on the allowlist as login: .
• Profile YAML never contains private keys, JWTs, or issued credential secrets.
• EasyTier / ZeroTier / WireGuard-only — no application-level identity (the mapping is gateway-credential).
• Treat device, node, or mesh membership as human identity.