fix(headscale): add MagicDNS override for pulsenode.pivoine.art

vpn-only (the ipAllowList middleware pulsenode now uses) checks the
connection's source IP, but being on the tailnet doesn't reroute
traffic to a normal public DNS hostname through the tunnel - Tailscale
only reroutes destinations it actually knows about. pulsenode.pivoine.art
had no such record, so it always resolved publicly for everyone,
tailnet or not, and Traefik never saw a tailnet-range source IP to
allow. Same fix already in place for triggershell.falcon.pivoine.art:
an extra_records override served only over MagicDNS, pointing to the
VPS's own tailnet IP so tailnet clients' connections actually traverse
the tunnel and satisfy the allowlist.

headscale/config.yaml

@@ -57,14 +57,18 @@ dns:
       - 1.1.1.1
       - 1.0.0.1
   search_domains: []
-  # Served only to tailnet clients via MagicDNS: overrides falcon.pivoine.art
-  # app hostnames to resolve to the VPS's tailscale IP instead of its public
+  # Served only to tailnet clients via MagicDNS: overrides these hostnames to
+  # resolve to the VPS's own tailscale IP (100.64.0.3) instead of its public
   # one, so VPN-connected clients route straight over the tunnel and satisfy
-  # Traefik's falcon-vpn-only IP allowlist.
+  # Traefik's vpn-only IP allowlist. Anyone not on the tailnet still gets the
+  # normal public DNS record and hits the same allowlist from outside it.
   extra_records:
     - name: "triggershell.falcon.pivoine.art"
       type: "A"
       value: "100.64.0.3"
+    - name: "pulsenode.pivoine.art"
+      type: "A"
+      value: "100.64.0.3"
 
 # TLS is terminated by Traefik; headscale itself serves plain HTTP internally.
 tls_letsencrypt_hostname: ""