feat: add Tailscale Funnel config for Claude AI connector testing

Add docker compose services (tailscale-mcp + nginx-claude-filter) behind
a claude-funnel profile that expose the login-flow MCP server via
Tailscale Funnel with IP-based access control:

- /mcp endpoint restricted to Claude AI outbound IPs (160.79.104.0/21)
- /oauth/*, /.well-known/*, /app paths open to all IPs (user login flow)
- All other paths return 404

Also add favicon.png served at /favicon.ico for connector directory
discovery (Google favicon service).

Usage:
  docker compose --profile login-flow --profile claude-funnel up -d

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

claude-funnel/serve-config.json

@@ -0,0 +1,19 @@
+{
+  "TCP": {
+    "443": {
+      "HTTPS": true
+    }
+  },
+  "Web": {
+    "${TS_CERT_DOMAIN}:443": {
+      "Handlers": {
+        "/": {
+          "Proxy": "http://nginx-claude-filter:8080"
+        }
+      }
+    }
+  },
+  "AllowFunnel": {
+    "${TS_CERT_DOMAIN}:443": true
+  }
+}