HS management interface restricted; use private tailnet endpoint