HEADSCALE_DEBUG_INSECURE_TLS_LISTEN_ADDR serves the router over throwaway TLS and marks the embedded region InsecureForTests: TLS DERP for CA-less clients (tailscale-rs, Android), plus the :443 noise fallback Go redials use.