The console routes to nodes (rendezvous), so it is the single public
port: server -> :8081 (no host forward), console -> :8080, 8090
forward dropped. Verified: node unreachable from host, routed
workstream creation lands on turnstone-vm-main at 127.0.0.1:8081,
route/command proxy works, cluster view tracks the workstream.
Console (cluster dashboard + admin panel) starts as a background
daemon under marvin on :8090, sharing the same config.toml and SQLite
DB (WAL multi-writer). Forwarded via run.sh and exposed through
tailcat; same login as the server.
tailcat (Tailscale data plane, no control plane) forwards the VM's
web UI and SSH ports to another machine via a stable saved-key
address; outbound-only, so it works through the nested slirp NAT.