fix(tailscale): drop a duplicate CLI install and a stale comment

Assisted-by: DeepSeek Harness 0.2.1-rc.2 (deepseek-flash)

hosts/12kingdoms-youko/vpn.nix

@@ -1,5 +1,4 @@
 {
-  pkgs,
   myvars,
   ...
 }:
@@ -7,13 +6,14 @@ let
   inherit (myvars.networking) hostsAddr k8sVip;
 in
 {
-  environment.systemPackages = [ pkgs.tailscale ];
+  # `services.tailscale` already puts the CLI in `environment.systemPackages`.
 
   services.tailscale = {
     enable = true;
     port = 41641;
     interfaceName = "tailscale0";
-    # allow the Tailscale UDP port through the firewall
+    # No-op here: the shared firewall opens 41641 in `extraInputRules` and
+    # forces `allowedUDPPorts` empty.
     openFirewall = true;
 
     useRoutingFeatures = "server";

modules/nixos/desktop/networking/tailscale.nix

@@ -1,6 +1,4 @@
 {
-  lib,
-  pkgs,
   ...
 }:
 # =============================================================
@@ -28,15 +26,15 @@
 #
 # =============================================================
 {
-  # make the tailscale command usable to users
-  environment.systemPackages = [ pkgs.tailscale ];
+  # `services.tailscale` already puts the CLI in `environment.systemPackages`.
 
   # enable the tailscale service
   services.tailscale = {
     enable = true;
     port = 41641;
     interfaceName = "tailscale0";
-    # allow the Tailscale UDP port through the firewall
+    # No-op here: the shared firewall opens 41641 in `extraInputRules` and
+    # forces `allowedUDPPorts` empty.
     openFirewall = true;
 
     useRoutingFeatures = "client";