If Tailscale is coming up with an authkey (notably: tsnet.Server.Up) and the auth key is bogus, we kinda just hang right now and don't surface the error.

You can start a subscription to https://pkg.go.dev/tailscale.com/client/tailscale#LocalClient.WatchIPNBusIf you get an ipn.Notify with the Health field set, there will be a ipn.Notify.Health.Warnings map entry with key "login-state" (health.LoginStateWarnable) telling you about the problem, but that's a lot of work just to get an error.

RegisterResponse contains an error string, but that might be due to some ephemeral server load issue, so we don't break the auth state machine and we keep trying.

If we instead had a"TerminalError bool" alongside the error, then we can tear down the state machine and make Up/tsnet.Server.Dial/etc return an error if the authkey is bogus.

/cc @raggi @willnorris @soniaappasamy @andrew-d @sailorfrag