servertest: support tagged pre-auth keys in test clients

WithTags was defined but never passed through to CreatePreAuthKey.
Fix NewClient to use CreateTaggedPreAuthKey when tags are specified,
enabling tests that need tagged nodes (e.g. via grant steering).

Updates #2180

hscontrol/servertest/client.go

@@ -105,9 +105,13 @@ func NewClient(tb testing.TB, server *TestServer, name string, opts ...ClientOpt
 	uid := types.UserID(user.ID)
 
 	var authKey string
-	if cc.ephemeral {
+
+	switch {
+	case cc.ephemeral:
 		authKey = server.CreateEphemeralPreAuthKey(tb, uid)
-	} else {
+	case len(cc.tags) > 0:
+		authKey = server.CreateTaggedPreAuthKey(tb, uid, cc.tags)
+	default:
 		authKey = server.CreatePreAuthKey(tb, uid)
 	}
 

hscontrol/servertest/server.go

@@ -175,6 +175,20 @@ func (s *TestServer) CreatePreAuthKey(tb testing.TB, userID types.UserID) string
 	return pak.Key
 }
 
+// CreateTaggedPreAuthKey creates a reusable pre-auth key with ACL tags.
+func (s *TestServer) CreateTaggedPreAuthKey(tb testing.TB, userID types.UserID, tags []string) string {
+	tb.Helper()
+
+	uid := userID
+
+	pak, err := s.st.CreatePreAuthKey(&uid, true, false, nil, tags)
+	if err != nil {
+		tb.Fatalf("servertest: CreateTaggedPreAuthKey: %v", err)
+	}
+
+	return pak.Key
+}
+
 // CreateEphemeralPreAuthKey creates an ephemeral pre-auth key.
 func (s *TestServer) CreateEphemeralPreAuthKey(tb testing.TB, userID types.UserID) string {
 	tb.Helper()