Fix exit node changes failing after authentication

[rh45-one]

Summary

• Change the exit node, incoming-block, accept-routes, and LAN-access toggles with tailscale set instead of tailscale up --reset.
• Stop the root retry from appending a second --reset and --operator. Current Tailscale rejects a duplicated flag, so authentication succeeded and the command then exited without applying the change.
• Show the command error when a privileged retry still fails.

Fixes #63

Test plan

• With Tailscale 1.102 and the user not set as operator, pick an exit node, authenticate, and confirm it changes
• Select None and confirm the exit node is cleared
• Toggle Block Incoming, Accept Routes, and Allow Direct Lan Access
• Confirm other preferences, such as netfilter mode, stay as they are

Made by a human, with a tiny bit of help from AI.