Immich: document Tailnet access for remote machine learning

[jackspiering]

Summary

Adds a usage note to the Immich README for running the machine learning container on another Tailnet device.

Follow-up to a report in #298: Immich could not reach a remote machine learning container, and the tailscale service logged rejected due to acl for port 3003. The cause is the Tailnet policy, not the compose file, so this is documentation only.

The note covers:

• The Tailnet policy must allow the Immich node to reach the machine learning host on TCP port 3003.
• TS_USERSPACE=false must stay set, because Immich opens connections to the Tailnet.
• The machine learning URL needs the host's Tailscale IP address, or its MagicDNS name with the dns block.

Checks

• rumdl check --config .markdownlint.yml services/immich/README.md: passed
• git diff --check: passed
• docker compose config --quiet: not run, no compose file changed
• Not tested against a live remote machine learning setup on a Tailnet