test: TailscaleUtil CGNAT range unit tests

[marcdhansen]

Summary

• Exposes is_tailscale_addr() in barrier::detail namespace so it can be tested without real network interfaces
• Adds 8 unit tests in src/test/unittests/net/TailscaleUtilTests.cpp covering:
  • First and last address in the 100.64.0.0/10 range (boundary)
  • Typical Tailscale address (100.100.100.100)
  • Addresses just below and just above the range
  • Loopback, RFC-1918, and zero address (all negative cases)

Test plan

• Build unittests target and confirm new tests pass
• Confirm no regression in existing net/ tests (FingerprintDatabase, SecureUtils)

🤖 Generated with Claude Code

[marcdhansen]

Parallel Agent Review — 3 reviewers (code, silent-failure, test-coverage)

Blockers (resolved before posting)

AddressJustBelowRange test had wrong hex constant (flagged by all 3 agents — fixed in 268179f)
0x6443FFFFu decodes to 100.67.255.255, which is inside the Tailscale range. EXPECT_FALSE would have failed at runtime. Corrected to 0x643FFFFFu (100.63.255.255).

Important (resolved before posting)

m_TailscaleMode uninitialized in AppConfig (flagged by 2 agents — fixed in 268179f)
bool m_TailscaleMode; had no in-class initializer, unlike m_RequireClientCertificate = false on the line below. Added = false to match the convention and prevent indeterminate value if loadSettings() is not called.

Important (open — pre-existing, not introduced by this PR)

Silent failures in TailscaleUtil.cpp have no logging:

• Unix path: getifaddrs failure returns {} silently — conflates a system error (ENOMEM, permission denied) with "Tailscale not installed"
• Windows path: if the second GetAdaptersAddresses call fails after the buffer-overflow retry, ret is discarded with no log

These are in the Phase 2 code; suggest filing a follow-up issue.

Suggestions

• No test for get_tailscale_address() itself — the PR is correctly scoped to white-box testing is_tailscale_addr. A brief comment in the test file explaining why (requires real network interfaces) would help future contributors.
• PrivateRfc1918NotInRange packs 3 assertions — splitting into named tests would give cleaner failure diagnostics.
• 0xFFFFFFFFu (all-ones/broadcast) not tested — not a correctness risk, but a common robustness canary for range functions.

Strengths

• Boundary testing (first, last, just-below, just-above) is exactly right for a range-check function
• Tests live in barrier::detail namespace — clean white-box approach without polluting public API
• CMakeLists uses GLOB_RECURSE — no build system changes needed
• Windows GetAdaptersAddresses retry pattern is correct
• --tailscale-mode correctly sets both m_tailscaleMode = true and m_enableCrypto = false atomically