MANUAL CHECK (not a bug): try office:phone over Tailscale from a phone #423

Not a real issue. Nothing is known to be broken. This is a hands-on check that only the owner can do (Tailscale on the Mac + a phone). Agents: leave it open and don't open PRs that close it.

Needs Tailscale on the Mac and phone (not installed on the dev Mac, so #422 couldn't test it live).

1. bun run office, then bun run office:phone (approve HTTPS for the tailnet if Serve asks)
2. Open the printed /lite link on the phone, sign in, check that terminals, boards and ✨ New task work over the websocket
3. bun run office:phone -- --off

If the websocket is refused, the Host header assumption in #422 is wrong; the fallback is passing --trust-proxy to the office.