docs: document ACL policy and Taildrive

- README: 新增「ACL 政策與 Taildrive」章節（啟用方式、現行規則、使用指令）
- OPERATIONS: 新增 ACL 政策管理 + Taildrive 操作章節
- CLAUDE.md: Core Components 加入 policy.hujson、image 改為 v0.29.0；補 policy 結構說明
- SUMMARY: 功能特色加入 ACL policy 與 Taildrive 檔案分享

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CLAUDE.md

@@ -50,8 +50,9 @@ Production deployment of **Headscale** - a self-hosted WireGuard control plane p
 ## Architecture
 
 ### Core Components
-- **Headscale Service**: Docker container (`headscale/headscale:latest`)
+- **Headscale Service**: Docker container, pinned to `headscale/headscale:v0.29.0` (do not use `:latest` — breaking config changes crash-loop the container)
 - **Configuration**: `/config/config.yaml` with extensive Chinese comments
+- **ACL Policy**: `/config/policy.hujson` (HuJSON), enabled via `policy.mode: file` + `policy.path`. Holds the allow-all ACL plus Taildrive `nodeAttrs`/`grants`
 - **Data Storage**: `/data` directory containing SQLite database, keys, and certificates
 - **Networking**: Three ports exposed (8080 HTTP API, 9090 metrics, 50443 gRPC)
 - **External Network**: Requires `shared-net` Docker network
@@ -64,6 +65,11 @@ The `config.yaml` file contains:
 - **Authentication**: API key and pre-authentication key system
 - **Database**: SQLite with WAL mode for performance
 
+The `policy.hujson` file contains:
+- **acls**: allow-all (`accept * -> *:*`) to preserve full-mesh — REQUIRED, removing it locks out every node
+- **nodeAttrs**: grants `drive:share` / `drive:access` to all nodes (Taildrive)
+- **grants**: `tailscale.com/cap/drive` with all shares set to `rw` (Taildrive read/write)
+
 ### Data Persistence Structure
 ```
 /data/