The tailscaled daemon starts as root (before user drop to hermes).
Without setting --operator, the hermes user gets 'checkprefs access
denied' when running 'tailscale up' manually.

Add 'tailscale set --operator=hermes' after the daemon is confirmed
ready so the unprivileged user can manage the tailnet connection.

Previously, tailscaled only started if TS_AUTHKEY was provided. This
meant manual 'tailscale up' (interactive auth URL flow) was impossible
after a fresh machine start — the daemon wasn't running.

Now tailscaled always starts if the binary exists. The auth-key based
'up' remains gated behind TS_AUTHKEY, but the daemon is available for
manual or interactive login regardless.