fix(host-service): authorize remote heartbeat pings

[brainage04]

What this changes

Allows protocol-level ping frames after remote connection policy state has been established.

Every post-hello remote frame passes through TailscaleRemotePolicy.authorize(), but heartbeat pings intentionally have no device capability. The generic missing-capability check therefore rejected the first ping and the server closed the socket with remote policy denied. The client starts heartbeats in both pairing and ready states, so the exception belongs immediately after the policy-state check rather than after principal authentication.

Commands, confirmations, terminal frames, leases, features, and capabilities retain their existing authorization paths. A ping only produces a pong containing the request nonce and server timestamp.

Adds a regression test covering all three boundaries:

• ping before policy state is denied
• ping while pairing is allowed
• ping after device authentication is allowed

How you verified it

• bun test packages/host-service/test/policy.test.ts — 12 passed, 0 failed
• pnpm check — release consistency, provenance, lint, Flutter analysis, and all workspace typechecks passed
• umask 022 && pnpm test — all workspace tests passed
• Live paired Linux client check — connection returned connected, remained paired and connected for 22 seconds across the 15-second first-heartbeat boundary, and reported no remote runtime errors

Checklist

• pnpm check passes (release contract, provenance, lint, typecheck)
• pnpm test passes; new behavior has a test that fails without this change
• Any pasted logs or screenshots are redacted: no secrets, tokens, pairing codes, or private paths
• Ported code (T3 Code / OMP) follows the provenance rules in THIRD_PARTY_NOTICES.md — not applicable; this is a T4-owned policy correction