gateway-domain: tag:orchestrator is now allowed by the ACL too

A rule was added so the testing gateway may also reach nodes tagged
tag:orchestrator, not only tag:notplants-test-server. Both tags now appear in
the skill's table, and the tool's warning fires only when a node carries
neither.

Verified end to end from an orchestrator box (tag:orchestrator, tag:server)
rather than assumed:

  - the gateway can open a TCP connection to it over the tailnet
  - a request to https://acltest.gtest.commoninternet.net/ returns the box's
    own self-signed certificate, subject and issuer both CN=acltest...,
    which is only possible if the gateway proxied the stream instead of
    terminating it
  - the payload came back and the box's listener logged the request

The troubleshooting section gains the one-liner that isolates this from the
gateway itself: open a TCP connection to your backend from the gateway.

tools/gateway-domain.py

@@ -97,10 +97,10 @@ _ERR = re.compile(r'<p style="color:red">(.*?)</p>', re.S)
 # /var/lib/tunnel-gateway/tunnel_map.conf can clear. Refuse to create one.
 _BACKEND = re.compile(r"^(\d{1,3}(?:\.\d{1,3}){3})(?::(\d{1,5}))?$")
 
-# The tailnet ACL only lets the gateway open connections to nodes carrying this tag.
+# The tailnet ACL only lets the gateway open connections to nodes carrying one of these.
 # A mapping to an untagged node is accepted by the gateway and then simply never
 # connects, which looks like a gateway fault and is not one.
-REQUIRED_TAG = "tag:notplants-test-server"
+ALLOWED_TAGS = ("tag:notplants-test-server", "tag:orchestrator")
 
 
 def _validate_backend(backend):
@@ -144,9 +144,10 @@ def _warn_untagged(exe):
     tags = _self_tags(exe)
     if tags is None:
         return
-    if REQUIRED_TAG not in tags:
+    if not any(t in tags for t in ALLOWED_TAGS):
         print(
-            f"warning: this node is not tagged {REQUIRED_TAG} (tags: {', '.join(tags) or 'none'}).\n"
+            f"warning: this node carries none of {' / '.join(ALLOWED_TAGS)} "
+            f"(tags: {', '.join(tags) or 'none'}).\n"
             "         The gateway will accept the mapping but the tailnet ACL will not let it\n"
             "         reach this box, so no traffic will flow. Add the tag in the Tailscale\n"
             "         admin, or map a backend that already has it.",