[Feature request] Per-profile advertised routes (subnet router / exit node) #15

Profiles can currently only consume routes and exit nodes, never offer them. A server that moves from tailscaled to tailmixd therefore loses exit-node / subnet-router duty with no path back. I would like tailmix to support per-profile advertised routes, approved in the admin console exactly like a normal node.

Proposal (implemented on a branch, see below):

• Desired routes persist in profile state and converge through the supervisor reconcile loop onto the engine prefs (AdvertiseRoutes), which control then lists for approval. Effective IPs stay unadvertised, as docs/design.md requires.
• The daemon owns the forwarding plane on Linux: scoped FORWARD accept plus MASQUERADE rules per advertised prefix on the shared host TUN, with IP-forwarding sysctl checks. Everything is torn down on clear, profile remove, or disable.
• Advertising refuses while tailscaled is running (related to Check for a clash with tailscale client #12) and outside Linux TUN mode.
• CLI: tailmix advertise list/set/clear --profile.

Prior art checked, no duplicate: the tracker has no exit-node or advertise issue. Related: #12 (tailscaled clash detection, this covers the advertise path), #13 (disconnect notice), and the Routing And Exit Nodes section of docs/design.md, which stays accurate since only LAN/exit prefixes are advertised, never effective IPs.

I have this working and use it to re-apply exit-node duty for one profile after switching off tailscaled. Proposed PR: #16 (david1gp/tailmix branch advertise-routes, 26 files, tests included). If per-profile advertisement is something you want in tailmix but not with this interface (state field plus advertise subcommand), I am happy to rework or split it up.