integration: add SSH check mode tests

Add ReadLog method to headscale integration container for log
inspection. Split SSH check mode tests into CLI and OIDC variants
and add comprehensive test coverage:

- TestSSHOneUserToOneCheckModeCLI: basic check mode with CLI approval
- TestSSHOneUserToOneCheckModeOIDC: check mode with OIDC approval
- TestSSHCheckModeUnapprovedTimeout: rejection on cache expiry
- TestSSHCheckModeCheckPeriodCLI: session expiry and re-auth
- TestSSHCheckModeAutoApprove: auto-approval within check period
- TestSSHCheckModeNegativeCLI: explicit rejection via CLI

Update existing integration tests to use headscale auth register.

Updates #1850

integration/hsic/hsic.go

@@ -699,6 +699,18 @@ func (t *HeadscaleInContainer) WriteLogs(stdout, stderr io.Writer) error {
 	return dockertestutil.WriteLog(t.pool, t.container, stdout, stderr)
 }
 
+// ReadLog returns the current stdout and stderr logs from the headscale container.
+func (t *HeadscaleInContainer) ReadLog() (string, string, error) {
+	var stdout, stderr bytes.Buffer
+
+	err := dockertestutil.WriteLog(t.pool, t.container, &stdout, &stderr)
+	if err != nil {
+		return "", "", fmt.Errorf("reading container logs: %w", err)
+	}
+
+	return stdout.String(), stderr.String(), nil
+}
+
 // SaveLog saves the current stdout log of the container to a path
 // on the host system.
 func (t *HeadscaleInContainer) SaveLog(path string) (string, string, error) {