[terraboops]

Authorized requests currently fail immediately when an upstream has no ready endpoints. Add opt-in request waiting so a platform autoscaler can observe pending demand, start the backend, and let the original request proceed once it is connectable.

The gate bounds pending requests and backend cardinality, shares TCP readiness checks, honors cancellation, and tracks active demand through streaming responses. The proxy reauthorizes and mints a fresh assertion after waiting; it never retries a forwarded application request. A validated tsjwt.dev/backend-wait-timeout Gateway annotation enables the feature, with metrics on the internal operations listener. Existing Gateways retain their current behavior.

This is the request-waiting foundation for BCP-148. It does not scale workloads or install a metrics adapter. Deployment adoption must follow the pinned-source release pipeline after native HPA prerequisites and all relevant ingress paths are ready. See docs/backend-waiting.md for the metric contract, readiness assumptions and rollback order.

Validation: race tests and vet pass in the core, tsnetid and gateway modules; new tests cover bounded waiting, cancellation, authorization before demand and after waiting, fresh assertions, single POST delivery, concurrent waiters, metric cardinality and streaming demand. No live resources changed.

CI also exposed existing reachable dependency vulnerabilities. Update klauspost/compress to v1.20.2 and golang.org/x/net to v0.60.0 in both Tailscale-consuming modules, including their required transitive updates. The patched dependencies raise tsnetid's minimum Go version to 1.26; the core remains Go 1.25 and stdlib-only. CI already uses Go 1.26.