feat: add tailscale proxy param

[leo-notte]

No description provided.

[greptile-apps]

Greptile Summary

This PR extends the session-start CLI command with Tailscale (tailnet) proxy support and external proxy flags, alongside the corresponding generated client types (TailnetProxy, AsTailnetProxy/FromTailnetProxy/MergeTailnetProxy). The mutual-exclusivity guard for proxy flags is a nice UX improvement. Two P2 findings: dependent sub-flags (--proxy-tailnet-client-secret, --proxy-external-username/password) are silently ignored when their parent flag is absent, and no tests were added for the new code paths.

Confidence Score: 5/5

Safe to merge — all findings are P2 (UX and test coverage), no correctness or data-integrity issues.

Generated client code follows established patterns exactly. The CLI logic is correct and the mutual-exclusivity guard works properly. Remaining findings are minor UX improvements (silent sub-flag discard) and missing test coverage.

internal/cmd/sessions.go — dependent sub-flag validation and test coverage

Important Files Changed

Filename	Overview
internal/api/client.gen.go	Generated file: adds TailnetProxy struct and corresponding As/From/Merge methods for both ApiSessionStartRequest and GlobalScrapeRequest union types, plus discriminator case — follows existing patterns exactly.
internal/cmd/sessions.go	Adds --proxy-external-* and --proxy-tailnet-* CLI flags with mutual-exclusivity enforcement; dependent sub-flags (client-secret, username, password) are silently dropped when the parent flag is absent; no tests added.

Prompt To Fix All With AI

This is a comment left during a code review.
Path: internal/cmd/sessions.go
Line: 344-354

Comment:
**Silent discard of dependent-only proxy flags**

If a user passes `--proxy-tailnet-client-secret` (or `--proxy-external-username` / `--proxy-external-password`) without their respective parent flag, the value is silently ignored because neither flag appears in the mutual-exclusivity check and the parent block never runs. A short guard warning the user would improve UX and help catch typos:

```go
if cmd.Flags().Changed("proxy-tailnet-client-secret") && !cmd.Flags().Changed("proxy-tailnet-client-id") {
    return fmt.Errorf("--proxy-tailnet-client-secret requires --proxy-tailnet-client-id")
}
```

The same pattern applies to `--proxy-external-username` and `--proxy-external-password`.

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: internal/cmd/sessions.go
Line: 504-570

Comment:
**No unit or integration tests added**

This PR introduces new proxy flag parsing logic (external proxy + Tailscale) but doesn't include any tests. Per the project's test guidelines, at least one integration test should accompany major feature additions. Consider adding a unit test that exercises the new flag combinations in `runSessionsStart` (e.g., happy-path for each proxy type, and the mutual-exclusivity rejection path).

**Context Used:** # Test guidelines
- Add a comment if the PR does n... ([source](https://app.greptile.com/review/custom-context?memory=instruction-0))

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (4): Last reviewed commit: "feat: expose external and tailnet proxie..." | Re-trigger Greptile}

[leo-notte]

@greptileai made some updates, plz rereview