wayvnc exits with status 0 when it loses its capture output (e.g. the idle daemon powering the screen off), so Restart=on-failure never brought it back. Restart=always + StartLimitIntervalSec=0 keeps it retrying until the output returns.
Binds to the tailscale IP only, with PAM auth over TLS. TLS cert/key are machine-local secrets and intentionally not tracked.