ipn/ipnlocal: stop netmap expiry timer on shutdown

magicsock: Do not fail NewConn on initial bind failure

Vendor go-json-experiment/json to fix build with Go 1.27

Export SetAppleTV

Export MagicDNSHosts and remove ExportFilter

control/controlbase: support connections without deadlines

control/controlbase: support connections without deadlines

Fix reconfig listener missing DNS-only changes

tsnet: Only enable netstack catch-all processing for fake TUN

ProcessLocalIPs and ProcessSubnets were set unconditionally,
causing netstack to intercept all inbound traffic including
ICMP echo replies. With a real TUN device, this prevents
replies from reaching the kernel networking stack.

Selective service intercepts (PeerAPI, SSH, Serve, VIP, 4via6)
in shouldProcessInbound still run without these flags.

Add tun device support