tailscale: Add tailssh server

docs/configuration/endpoint/tailscale.md

@@ -2,6 +2,10 @@
 icon: material/new-box
 ---
 
+!!! quote "Changes in sing-box 1.14.0"
+
+    :material-plus: [ssh_server](#ssh_server)
+
 !!! quote "Changes in sing-box 1.13.0"
 
     :material-plus: [relay_server_port](#relay_server_port)  
@@ -36,6 +40,7 @@ icon: material/new-box
   "system_interface_name": "",
   "system_interface_mtu": 0,
   "udp_timeout": "5m",
+  "ssh_server": false,
 
   ... // Dial Fields
 }
@@ -148,6 +153,49 @@ UDP NAT expiration time.
 
 `5m` will be used by default.
 
+#### ssh_server
+
+!!! question "Since sing-box 1.14.0"
+
+Run a Tailscale SSH server on tailnet port 22.
+
+Access is controlled by the SSH ACL in the Tailscale admin console, which maps each connection to a local user. How that user is resolved, and which users are allowed, depends on the platform:
+
+- **Linux** and **macOS**: the user is resolved from the system user database. Switching to a user other than the one sing-box runs as requires running as root; without root, sessions are limited to the current user.
+- **Windows**: sessions run as the sing-box process identity; the mapped user is not impersonated, so a session mapped to a different local account is refused.
+- **Android**: the user is resolved by the app rather than the system user database. `root` is the superuser (UID 0) and `shell` is the ADB shell user (UID 2000); every other name is resolved as the package name of an installed application, running as that application's UID with its data directory as the home directory, so the target application must be installed. `termux` is a shortcut for `com.termux`, and `sing-box` for the app's own package name; when Termux is installed, the `root` and `termux` users load the Termux environment. Running as the sing-box application itself requires no root, while any other user requires granted root access; without root, sessions are limited to the sing-box user.
+- **macOS**: the SSH server is only available in the standalone version and requires the Root Helper; the App Store version is not supported.
+- **iOS** and **tvOS**: not yet supported.
+
+Object format:
+
+```json
+{
+  "enabled": true,
+  "disable_pty": false,
+  "disable_sftp": false,
+  "disable_forwarding": false
+}
+```
+
+Setting `ssh_server` value to `true` is equivalent to `{ "enabled": true }`.
+
+#### ssh_server.enabled
+
+Enable the SSH server.
+
+#### ssh_server.disable_pty
+
+Refuse PTY allocation requests.
+
+#### ssh_server.disable_sftp
+
+Refuse the SFTP subsystem.
+
+#### ssh_server.disable_forwarding
+
+Refuse local and remote TCP and Unix-socket forwarding, including SSH agent forwarding.
+
 ### Dial Fields
 
 !!! note