Add accept-time node identity backed by a netmap-mirror cache

[danReynolds]

What

Inbound TCP/TLS accepts and Http.bind requests now carry the calling node's identity — conn.identity / request.identity — resolved at accept time without a per-accept LocalAPI round-trip.

final server = await tsnet.http.bind(port: 8080);
await for (final req in server.requests) {
  final id = req.identity; // TailscaleNodeIdentity?
  if (id == null || !id.tags.contains('tag:prod')) {
    await req.respond(statusCode: 403, body: 'forbidden');
    continue;
  }
  await req.respond(body: 'hello ${id.hostName}');
}

Three connected changes

1. Fix LocalAPI loopback latency (~350×). local.Client.DoLocalRequest forks lsof per request (safesocket.readMacosSameUserProof) hunting a macOS GUI credential file that an embedded tsnet process never has. Setting OmitAuth skips it, cutting whois() from ~40 ms to ~230 µs. This was slowing every LocalAPI call (status/prefs/ping), not just whois. A gated diagnostic test (loopback_latency_diag_test.go) localizes the cost and asserts the direction of the win without pinning machine-specific numbers.

2. Netmap-mirror identity cache. The state watcher rebuilds an addr → identity index on every netmap tick; the accept path reads it in ~79 ns / 0 allocs instead of a live WhoIs.

Path	Cost	Allocs
Loopback (cold)	~40 ms	572
Cached (warm)	79 ns	0

Safety: cold or post-StopWatch lookups fall back to the authoritative loopback WhoIs, so identity is never stale — at worst one netmap behind, never an IP misattribution. WhoIs and the cache share one mapper (nodeIdentityFromView) so they can't drift.

3. HTTP request identity. TailscaleHttpRequest.identity, attached via the same cache-backed lookup — the in-process twin of serve.forward's Tailscale-User-Login headers.

Identity is correctly absent on outbound tcp.dial (caller chose the target), public Funnel callers (no tailnet node), and UDP (connectionless). The user-facing whois() stays on the live — now fast — loopback.

Testing

• Go unit: cache builder, lookup/invalidate semantics, WhoIs→identity mapping.
• Go bench (Headscale-gated): loopback vs cached vs pure-map floor.
• e2e over Headscale: inbound TCP and inbound HTTP both assert the peer's identity over the wire. Full 37-test e2e suite green; dart analyze clean; go vet clean.

🤖 Generated with Claude Code