fix(tsconnect): link fork features into the wasm build

Upstream's wasmbuild.Keep is scoped to its SSH-in-browser client and omits
acme, serve, taildrop, drive and the exit node features. The JS bridge in
this fork exposes all of them, so they have to stay linked in.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

cmd/tsconnect/wasmbuild/wasmbuild.go

@@ -55,24 +55,34 @@ var baseTags = []string{
 //   - "captiveportal": the browser handles captive portal detection
 //     in front of us.
 //   - "syspolicy": no MDM in a browser.
-//   - "drive", "taildrop", "peerapi*": no local filesystem.
 //   - "clientupdate": no binary self-update.
 //   - "dbus", "resolved", "networkmanager", "iptables", "linkspeed",
 //     "linuxdnsfight", "listenrawdisco", "osrouter", "synology",
 //     "systray", "tundevstats", "wakeonlan": OS integrations not
 //     applicable to a browser-hosted client.
 //   - "aws", "cloud", "kube", "bird", "appconnectors", "conn25",
-//     "relayserver", "serve", "acme", "tap", "tpm", "doctor",
+//     "relayserver", "tap", "tpm", "doctor", "advertiseroutes",
-//     "advertiseroutes", "advertiseexitnode", "useroutes",
+//     "useroutes": server-side or otherwise out of scope.
-//     "useexitnode": server-side or otherwise out of scope for the
+//
-//     SSH-in-browser / fetch-in-browser use case.
+// This fork keeps considerably more than upstream's SSH-in-browser
+// build: the JS bridge exposes Taildrop, Taildrive, Funnel/serve, ACME
+// certs and exit node selection, all of which need their feature linked
+// in. The taildrop/drive FileOps are backed by JS callbacks rather than
+// a real filesystem, so the usual "no local filesystem" objection to
+// linking them into wasm doesn't apply here.
 var Keep = []featuretags.FeatureTag{
-	"c2n",      // control-to-node mechanism the control client invokes
+	"acme",              // getCert / listenTLS need ACME cert issuance
-	"dns",      // MagicDNS resolution in-process
+	"advertiseexitnode", // exit node advertisement via the JS bridge
-	"health",   // ipnstate/ipnlocal reference health warnables pervasively
+	"c2n",               // control-to-node mechanism the control client invokes
-	"ipnbus",   // notification bus for state/netmap callbacks
+	"dns",               // MagicDNS resolution in-process
-	"logtail",  // log upload (browser console + remote)
+	"drive",             // Taildrive WebDAV server exposed to JS
-	"netstack", // userspace networking; wasm has no kernel TUN
+	"health",            // ipnstate/ipnlocal reference health warnables pervasively
+	"ipnbus",            // notification bus for state/netmap callbacks
+	"logtail",           // log upload (browser console + remote)
+	"netstack",          // userspace networking; wasm has no kernel TUN
+	"serve",             // setFunnel / listenTLS serve config
+	"taildrop",          // file send/receive over a JS-backed FileOps
+	"useexitnode",       // exit node selection exposed to JS
 }
 
 func init() {