Muse Local Gateway

# Muse Local Gateway

Community skill, not an official Muse feature. Source and setup: https://github.com/Toddoward/muse-local-gateway

## What the user runs
A small stack on their machine, reachable only over their tailnet:

| Port | Service | What it does |
|---|---|---|
| `8730` | gateway | `PUT /files/<path>` writes into the user's shared folder |
| `8731` | bench | `POST /exec` runs `sh -c` in a container; the shared folder is `/work` |

The bench has no secrets, no Docker socket, and (by default) no route to the user's computer or
LAN. Its internet goes through a proxy. The user chose one network mode at install:

| Mode | The bench can reach |
|---|---|
| `isolated` (default) | Internet via proxy (pip, git, npm, ESP-IDF components). Host and LAN refused (`403`) |
| `lan-allow` | Above + the LAN devices the user listed, over HTTP(S) only |
| `open` | Host and LAN directly, every protocol |

A `403` from the proxy is the user's choice, not a fault. Never try to get around it — say which
address was refused and that the user can change the mode.

## Procedure
1. `tailscale status` — is the user's gateway node listed? If not, run `tailscale up`, show the
   approval link, wait. Then ask the user to tag this device `tag:muse` in their admin console
   (until then the tailnet ACL lets you nowhere, or — worse — everywhere).
2. `bin/gateway-check.sh <ip>:8730` — expect `OK`.
3. Files in: `bin/gateway-put.sh <ip>:8730 <local-file> <path>`. Paths are relative; `..`,