Remove the vpn-setup/ directory (Headscale/Tailscale scripts, CoreDNS,
onboarding) and add a lightweight access code gate instead. Visitors
must enter a code to view the site — validated via API route with an
httpOnly cookie persisted for 1 year.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
