bru tunnel server. control plane on :7000, dashboard is tailnet-only.