Single Go binary that proxies MCP requests to multiple backends with
identity-based access control, audit logging, and session recording.

Uses Tailscale tsnet for automatic TLS and WhoIs-based identity.
Policy via tailnet ACL grants or YAML fallback. Per-tool deny globs,
session recording, and a web dashboard with request charts and
server management.