state: apply a new pre-auth key's tags on re-registration

An already-tagged node re-authenticating with a fresh, differently-tagged
pre-auth key had the key validated and consumed but its tags discarded;
only a user-owned->tagged conversion applied them. Re-key when the
presented key differs from the node's current AuthKeyID, matching
Tailscale's documented retag-by-rekey (KB 1068). Same-key re-auth still
preserves tags and admin overrides.

Applying a differently-tagged key is an authorization decision, so a retag
forces key validation instead of riding the same-NodeKey fast path; a
spent, revoked or expired key can no longer retag a node.

Also persist AuthKeyID on the re-registration write. It was set in the
NodeStore but excluded from the column set (#2862, to avoid persisting a
deleted key's stale reference on MapRequest), so a restart reloaded the
old key and any key-scoped property (notably Ephemeral) silently reverted,
risking GC of a node meant to be persistent. The re-registration key is
freshly validated, so persisting it is safe; the MapRequest path is
unchanged.

Fixes #3370

Author: kradalby

CHANGELOG.md

@@ -45,6 +45,7 @@ keys remain all-access.
 - Expiring or deleting a non-existent pre-auth key now returns an error instead of silently succeeding [#3324](https://github.com/juanfont/headscale/pull/3324)
 - Improve systemd service file hardening [#3341](https://github.com/juanfont/headscale/pull/3341)
 - A tagged node can re-authenticate after `tailscale logout` again: logout no longer stamps a key expiry on a tagged node, and a stale expiry left by an older version is cleared on re-registration [#3371](https://github.com/juanfont/headscale/issues/3371)
+- Re-registering a tagged node with a different pre-auth key now applies the new key's tags instead of silently keeping the old ones, and persists the new key reference so a node's ephemeral status no longer reverts on restart [#3370](https://github.com/juanfont/headscale/issues/3370)
 
 ## 0.29.2 (2026-07-01)