Default VPN to Tailscale, add auth key expiry warning

Tailscale handles NAT traversal automatically via DERP relay — more
reliable than WireGuard for devices landing on unknown networks.
Add reminder to use reusable non-expiring keys for long-term drops.

operator_setup.sh

@@ -317,7 +317,7 @@ echo "  [1] None"
 echo "  [2] Tailscale"
 echo "  [3] WireGuard"
 echo "  [4] Reverse SSH Tunnel (autossh) — no traffic until operator connects"
-prompt_default vpn_opt "Select VPN (1-4)" "1"
+prompt_default vpn_opt "Select VPN (1-4)" "2"
 
 BB_VPN="none"
 TAILSCALE_KEY=""
@@ -333,6 +333,7 @@ if [[ "$vpn_opt" == "1" ]]; then
     BB_VPN="none"
 elif [[ "$vpn_opt" == "2" ]]; then
     BB_VPN="tailscale"
+    echo -e "  ${YELLOW}Use a reusable, non-expiring key from Tailscale admin → Settings → Auth keys${NC}"
     prompt_default tailscale_key "Tailscale auth key" ""
     TAILSCALE_KEY="$tailscale_key"
 elif [[ "$vpn_opt" == "3" ]]; then