feat(tailscale): enable mesh networking across NixOS hosts

- enable Tailscale on Bob, Brain, Jeeves, and Rhapsody
- configure the Jeeves binary cache through Tailscale MagicDNS
- trust the existing workshop cache signing key

common/optional/tailscale.nix

@@ -6,6 +6,12 @@
 {
   networking.firewall.trustedInterfaces = [ "tailscale0" ];
 
+  nix.settings = {
+    trusted-substituters = [ "http://jeeves:5000" ];
+    substituters = [ "http://jeeves:5000/?priority=1&want-mass-query=true" ];
+    trusted-public-keys = [ "cache.tmmworkshop.com:jHffkpgbmEdstQPoihJPYW9TQe6jnQbWR2LqkNGV3iA=" ];
+  };
+
   services.tailscale = {
     enable = true;
     openFirewall = true;