Supervisor retry fix and expired-key node filter

Added

• Nodes: filter for nodes whose key expiry has passed (“Key expired”).

Fixed

• The headscale supervisor stopped retrying for good after a start timeout, leaving headscale down (and the restart button a silent no-op) until headscale-admin itself was restarted.
• Starting with auth enabled and no admin principal is now refused instead of only logged, which left the admin surface unreachable.
• A deleted principal read as logged-in on /auth/me, bouncing the console between the app and the sign-in page until the session cookie expired.
• Pausing headscale for a backup or version switch no longer has to wait out the restart backoff, which could exceed the pause deadline while headscale was crash-looping.

Security

• The generated headscale.yaml now sets unix_socket_permission: "0700" (was 0770): the socket has no authentication of its own, so group access granted full headscale management.
• headscale-pf apply in policy file mode validates the policy with CheckPolicy before writing it, so an invalid policy can no longer put the control plane into a restart loop.

Changed

• Go 1.26.5.
• Frontend dependency updates (SvelteKit 2.70.1, Svelte 5.56.8).