client/web: invert auth logic for synology and qnap

Add separate server methods for synology and qnap, and enforce
authentication and authorization checks before calling into the actual
serving handlers. This allows us to remove all of the auth logic from
those handlers, since all requests will already be authenticated by that
point.

Also simplify the Synology token redirect handler by using fetch.

Remove the SynologyUser from nodeData, since it was never used in the
frontend anyway.

Updates tailscale/corp#13775

Signed-off-by: Will Norris <will@tailscale.com>

client/web/api.go

@@ -20,16 +20,12 @@ type api struct {
 // which protects the handler using gorilla csrf.
 func (a *api) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("X-CSRF-Token", csrf.Token(r))
-	user, err := authorize(w, r)
-	if err != nil {
-		return
-	}
 	path := strings.TrimPrefix(r.URL.Path, "/api")
 	switch path {
 	case "/data":
 		switch r.Method {
 		case httpm.GET:
-			a.s.serveGetNodeDataJSON(w, r, user)
+			a.s.serveGetNodeDataJSON(w, r)
 		case httpm.POST:
 			a.s.servePostNodeUpdate(w, r)
 		default: