feat: enforce isolation between WonderNets with empty ACL policy

[STRRL]

Summary

• Switch from autogroup:self ACL policy (which allows all traffic with *:*) to empty policy (deny all by default) to enforce network isolation between different users' WonderNets
• Add E2E isolation test (e2e/test-isolation.sh) that verifies both API and network isolation
• Add test infrastructure: worker-4/5 containers and testuser2 for multi-user testing

Closes #84

Test plan

• Run ./e2e/test-isolation.sh to verify isolation works
• Verify API isolation: each user only sees their own nodes via /coordinator/api/v1/nodes
• Verify network isolation: workers from User 1's WonderNet cannot ping workers from User 2's WonderNet
• Verify intra-WonderNet connectivity still works (workers in same WonderNet can communicate)

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

pkg/headscale/acl.go:100

• The functions GenerateEmptyPolicy and SetEmptyPolicy are not used anywhere in the codebase. The actual implementation uses SetWonderNetIsolationPolicy which generates proper isolation rules. These functions appear to be dead code that should either be removed or properly integrated if they serve a future purpose.

// SetEmptyPolicy sets an empty ACL policy (deny all by default, isolation enforced)
func (am *ACLManager) SetEmptyPolicy(ctx context.Context) error {
	am.mu.Lock()
	defer am.mu.Unlock()

	policy := GenerateEmptyPolicy()
	policyJSON, err := json.Marshal(policy)
	if err != nil {
		return fmt.Errorf("marshal policy: %w", err)
	}

	_, err = am.client.SetPolicy(ctx, &v1.SetPolicyRequest{Policy: string(policyJSON)})
	return err

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.