feat: add Tailscale Funnel config for Claude AI connector testing

Add docker compose services (tailscale-mcp + nginx-claude-filter) behind
a claude-funnel profile that expose the login-flow MCP server via
Tailscale Funnel with IP-based access control:

- /mcp endpoint restricted to Claude AI outbound IPs (160.79.104.0/21)
- /oauth/*, /.well-known/*, /app paths open to all IPs (user login flow)
- All other paths return 404

Also add favicon.png served at /favicon.ico for connector directory
discovery (Google favicon service).

Usage:
  docker compose --profile login-flow --profile claude-funnel up -d

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -303,6 +303,7 @@ services:
     environment:
       - NEXTCLOUD_HOST=http://app:80
       - NEXTCLOUD_MCP_SERVER_URL=http://localhost:8004
+      #- NEXTCLOUD_MCP_SERVER_URL=https://nextcloud-mcp-dev.tail148d5.ts.net
       - NEXTCLOUD_PUBLIC_ISSUER_URL=http://localhost:8080
 
       # Login Flow v2 (ADR-022)
@@ -324,6 +325,38 @@ services:
     profiles:
       - login-flow
 
+  # Tailscale Funnel for Claude AI connector testing
+  # Usage: docker compose --profile login-flow --profile claude-funnel up --build -d
+  # Requires: TS_AUTHKEY in .env file (see env.sample.claude-funnel)
+  tailscale-mcp:
+    image: tailscale/tailscale:latest
+    hostname: nextcloud-mcp-dev
+    restart: always
+    environment:
+      - TS_AUTHKEY=${TS_AUTHKEY}
+      - TS_STATE_DIR=/var/lib/tailscale
+      - TS_SERVE_CONFIG=/config/serve-config.json
+      - TS_HOSTNAME=nextcloud-mcp-dev
+      - TS_EXTRA_ARGS=--advertise-tags=tag:container
+    volumes:
+      - tailscale-state:/var/lib/tailscale
+      - ./claude-funnel/serve-config.json:/config/serve-config.json:ro
+    cap_add:
+      - NET_ADMIN
+      - SYS_MODULE
+    profiles:
+      - claude-funnel
+
+  nginx-claude-filter:
+    image: docker.io/library/nginx:alpine
+    restart: always
+    depends_on:
+      - mcp-login-flow
+    volumes:
+      - ./claude-funnel/nginx.conf:/etc/nginx/nginx.conf:ro
+    profiles:
+      - claude-funnel
+
   qdrant:
     image: docker.io/qdrant/qdrant:v1.17.1@sha256:94728574965d17c6485dd361aa3c0818b325b9016dac5ea6afec7b4b2700865f
     restart: always
@@ -354,3 +387,4 @@ volumes:
   qdrant-data:
   mcp-data:
   multi-user-basic-data:
+  tailscale-state: