Branch
This branch is an execution lane inside Remote Access and Security: closely related guides, builds, and validation work that should stay clustered instead of scattering across the library.
Create one explicit Windows remote-admin path where RDP is reachable only over the intended Tailscale network and identity policy, then prove both allowed and denied access paths.
Build one concrete two-interface Raspberry Pi travel-gateway topology, route only home-lab subnets through WireGuard, and prove behavior from a genuinely external network.
