feat: add Tailscale Funnel config for Claude AI connector testing

Add docker compose services (tailscale-mcp + nginx-claude-filter) behind
a claude-funnel profile that expose the login-flow MCP server via
Tailscale Funnel with IP-based access control:

- /mcp endpoint restricted to Claude AI outbound IPs (160.79.104.0/21)
- /oauth/*, /.well-known/*, /app paths open to all IPs (user login flow)
- All other paths return 404

Also add favicon.png served at /favicon.ico for connector directory
discovery (Google favicon service).

Usage:
  docker compose --profile login-flow --profile claude-funnel up -d

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

env.sample.claude-funnel

@@ -0,0 +1,22 @@
+# Claude AI Connector - Tailscale Funnel Configuration
+#
+# This profile exposes the MCP server (login-flow mode) via Tailscale Funnel
+# for testing Claude AI connector integration.
+#
+# Usage:
+#   1. Copy this file to .env and fill in TS_AUTHKEY
+#   2. Run: docker compose --profile login-flow --profile claude-funnel up --build -d
+#   3. Configure Claude.ai connector with: https://nextcloud-mcp-dev.<tailnet>.ts.net/mcp
+#
+# Prerequisites:
+#   - Generate auth key at https://login.tailscale.com/admin/settings/keys
+#     with tag:container and reusable=yes
+#   - Ensure Tailscale ACL allows funnel for tag:container:
+#     "nodeAttrs": [{ "target": ["tag:container"], "attr": ["funnel"] }]
+#
+# Security:
+#   - /mcp endpoint restricted to Claude AI IPs (160.79.104.0/21)
+#   - /oauth/* and /.well-known/* open to all IPs (needed for user login flow)
+#   - All other paths return 404
+
+TS_AUTHKEY=tskey-auth-REPLACE_ME