auth, state: keep announced routes out of pending registrations

Routes are the one long list; the first MapRequest reports them.
A relogin keeps the node's own routes until then.

hscontrol/types/registration.go

@@ -13,11 +13,9 @@ import (
 // only the fields the registration callback path actually consumes when
 // promoting a pending registration to a real node.
 //
-// Combined with the bounded-LRU cache that holds these entries, this caps
-// the worst-case memory footprint of unauthenticated cache-fill attempts
-// at (max_entries × per_entry_size). The cache is sized so that the
-// product is bounded to a few MiB even with attacker-supplied 1 MiB
-// Hostinfos (the Noise body limit).
+// Any client can open a pending registration. The bounded-LRU cache that
+// holds these entries caps their number, and each entry stays small: its
+// Hostinfo is bounded at decode ([BoundHostinfo]) and kept without routes.
 type RegistrationData struct {
 	// MachineKey is the cryptographic identity of the machine being
 	// registered. Required.
@@ -34,11 +32,11 @@ type RegistrationData struct {
 	// Already validated/normalised by EnsureHostname at producer time.
 	Hostname string
 
-	// Hostinfo is the original [tailcfg.Hostinfo] from the [tailcfg.RegisterRequest],
-	// stored so that the auth callback can populate the new node's
-	// initial [tailcfg.Hostinfo] (and so that observability/CLI consumers see
-	// fields like OS, OSVersion, and IPNVersion before the first
-	// [tailcfg.MapRequest] restores the live set).
+	// Hostinfo is the [tailcfg.Hostinfo] from the [tailcfg.RegisterRequest]
+	// without its routes, stored so that the auth callback can populate the
+	// new node's initial [tailcfg.Hostinfo] (and so that observability/CLI
+	// consumers see fields like OS, OSVersion, and IPNVersion before the
+	// first [tailcfg.MapRequest] restores the live set, routes included).
 	//
 	// May be nil if the client did not send [tailcfg.Hostinfo] in the original
 	// [tailcfg.RegisterRequest].