> Tailscale also provides an authentication layer (ie username/login/passwords)

Unless I'm misunderstanding you, I don't think it does (having to use a a third party to sign in is one of the main reasons I haven't tried it yet). From https://tailscale.com/kb/1013/sso-providers/: "Tailscale never handles authentication itself."