relay1: migrate to wstunnel + WireGuard subnet relay via Headscale

Replace the OpenVPN/OCServ path with a cleaner wstunnel-terminated WireGuard relay on :443, advertise/approve corporate subnet routes through Headscale, and add wsl DNS/route plumbing for tailnet access.

modules/headscale.nix

@@ -37,6 +37,13 @@ in
               "lefoyer.lu" = "10.33.0.100";
             };
           };
+          extra_records = [
+            {
+              name = "wsl.ts.net";
+              type = "A";
+              value = "10.250.250.2";
+            }
+          ];
         };
       };
     };