feat(gateway): add device auto-approve policy for Tailscale connections

Add gateway.devices.autoApprove config option to auto-approve device
pairing when requests come via Tailscale Serve with verified identity.

- Add "none" (default) and "tailscale" modes for autoApprove policy
- Auto-approve devices when Tailscale auth succeeds (verified via whois)
- Add autoApproved/autoApproveReason fields to device.pair.resolved event
- Add security audit info finding when tailscale mode is enabled
- Add comprehensive tests for config validation and auto-approve logic
- Add documentation in gateway configuration guide

Fixes #3795

docs/gateway/configuration.md

@@ -2861,6 +2861,14 @@ Trusted proxies:
 - When a connection comes from one of these IPs, OpenClaw uses `x-forwarded-for` (or `x-real-ip`) to determine the client IP for local pairing checks and HTTP auth/local checks.
 - Only list proxies you fully control, and ensure they **overwrite** incoming `x-forwarded-for`.
 
+Device auto-approve:
+- `gateway.devices.autoApprove` controls whether new device pairing requests are auto-approved.
+- Valid values: `"none"` (default) or `"tailscale"`.
+- `"none"`: only local (loopback) connections are auto-approved; remote connections require manual approval.
+- `"tailscale"`: auto-approve when the connection authenticates via Tailscale Serve identity (verified via `tailscale whois`).
+- This is useful for personal tailnets where you trust all machines on your network.
+- For shared or corporate tailnets, consider keeping `"none"` and approving devices manually.
+
 Notes:
 - `openclaw gateway` refuses to start unless `gateway.mode` is set to `local` (or you pass the override flag).
 - `gateway.port` controls the single multiplexed port used for WebSocket + HTTP (control UI, hooks, A2UI).