policy/v2: add exit node auto-approval compat tests

15 scenarios (ea1-ea15) covering exitNode field, routes map, both,
wrong tags, dual nodes, and baselines.

SaaS only approves exit routes via exitNode field. Exit routes in
the routes map are ignored for exit approval but still wildcard
subnet approval. Headscale already matches this behavior.

Remove IsExitRoute skip from TestRoutesCompatAutoApproval.

Updates #3157
Updates #3178

hscontrol/policy/v2/tailscale_routes_data_compat_test.go

@@ -42,7 +42,6 @@ import (
 	"github.com/stretchr/testify/require"
 	"go4.org/netipx"
 	"gorm.io/gorm"
-	"tailscale.com/net/tsaddr"
 	"tailscale.com/tailcfg"
 )
 
@@ -774,22 +773,6 @@ func TestRoutesCompatAutoApproval(t *testing.T) {
 					for _, routeStr := range nodeDef.RoutableIPs {
 						route := netip.MustParsePrefix(routeStr)
 
-						// Skip exit routes (0.0.0.0/0, ::/0).
-						// Tailscale SaaS stores exit routes
-						// under autoApprovers.routes alongside
-						// regular subnets, while headscale uses
-						// a separate autoApprovers.exitNode
-						// field. NodeCanApproveRoute checks the
-						// exitSet (from exitNode) first and
-						// never reaches the autoApproveMap
-						// (from routes), causing a known format
-						// mismatch. This is not a bug — just a
-						// structural difference in where exit
-						// routes are declared.
-						if tsaddr.IsExitRoute(route) {
-							continue
-						}
-
 						wantApproved := approvedSet[route]
 						gotApproved := pm.NodeCanApproveRoute(
 							node.View(), route,