Gate MULTI-evolve through private auth

[mulatta]

Expose MULTI-evolve Streamlit only through the private tailnet path and Authentik forward auth.

Highlights:

• Add the multievolve NixOS module on psi.
• Add Headscale DNS, ACME sync, Authentik forward-auth app, and Gatus check.
• Keep nginx proxy headers explicit so Authentik outpost subrequests avoid duplicate forwarded headers.

Depends on #603.

[mulatta]

This change is part of the following stack:

• Gate MULTI-evolve through private auth #604 ◀

_{Change managed by git-spice.}