A pain point you mention is that everyone must run the tailscale client. Have you considered exposing everything on the public internet using something like Clo

A pain point you mention is that everyone must run the tailscale client. Have you considered exposing everything on the public internet using something like Cloudflare Tunnels? You can have cloudflare handle auth on their edge network, which mitigates the worry about having to deal with 0-days on a self hosted auth solution. You have a pretty sophisticated directory setup tho so I'm not sure how well this would fit in with the existing infra.