state: refresh policy nodes inside the peer map build

One peer build per tag/user/IP/route write; callers detect policy moves
via NodesGeneration. Per-node caches only store results for the node
pm holds, so a mapper reading mid-build cannot pin a stale filter.

hscontrol/auth.go

@@ -263,12 +263,12 @@ func (h *Headscale) handleLogout(
 	}
 
 	updatedNode, c, err := h.state.SetNodeExpiry(node.ID(), &expiry)
+	h.Change(c)
+
 	if err != nil {
 		return nil, fmt.Errorf("setting node expiry: %w", err)
 	}
 
-	h.Change(c)
-
 	return nodeToRegisterResponse(updatedNode), nil
 }
 
@@ -420,6 +420,8 @@ func (h *Headscale) handleRegisterWithAuthKey(
 		machineKey,
 	)
 	if err != nil {
+		h.Change(changed)
+
 		if errors.Is(err, gorm.ErrRecordNotFound) {
 			return nil, NewHTTPError(http.StatusUnauthorized, "invalid pre auth key", nil)
 		}
@@ -451,13 +453,14 @@ func (h *Headscale) handleRegisterWithAuthKey(
 	// TODO(kradalby): This needs to be ran as part of the batcher maybe?
 	// now since we dont update the node/pol here anymore
 	routesChange, err := h.state.AutoApproveRoutes(node)
-	if err != nil {
-		return nil, fmt.Errorf("auto approving routes: %w", err)
-	}
 
 	// Send both changes. Empty changes are ignored by Change().
 	h.Change(changed, routesChange)
 
+	if err != nil {
+		return nil, fmt.Errorf("auto approving routes: %w", err)
+	}
+
 	resp := &tailcfg.RegisterResponse{
 		MachineAuthorized: true,
 		NodeKeyExpired:    node.IsExpired(),