integration: add SSH check mode tests

Add ReadLog method to headscale integration container for log
inspection. Split SSH check mode tests into CLI and OIDC variants
and add comprehensive test coverage:

- TestSSHOneUserToOneCheckModeCLI: basic check mode with CLI approval
- TestSSHOneUserToOneCheckModeOIDC: check mode with OIDC approval
- TestSSHCheckModeUnapprovedTimeout: rejection on cache expiry
- TestSSHCheckModeCheckPeriodCLI: session expiry and re-auth
- TestSSHCheckModeAutoApprove: auto-approval within check period
- TestSSHCheckModeNegativeCLI: explicit rejection via CLI

Update existing integration tests to use headscale auth register.

Updates #1850

integration/auth_web_flow_test.go

@@ -312,7 +312,7 @@ func TestAuthWebFlowLogoutAndReloginNewUser(t *testing.T) {
 		}
 
 		// Register all clients as user1 (this is where cross-user registration happens)
-		// This simulates: headscale nodes register --user user1 --key <key>
+		// This simulates: headscale auth register --auth-id <id> --user user1
 		_ = scenario.runHeadscaleRegister("user1", body)
 	}