Locking down a personal-agent box: Tailscale, sshd, and ufw in the right order

The three-step lockdown for a personal-agent VPS, why the order matters, and what ufw actually does when you turn it on.