addon-tailscale VS addon-ssh

I did file an issue asking them to make that flag, along with the --advertise-exit-node flag which is also hard-coded, optional.

I appreciate that Tailscale runs the DNS server so it's one less thing for me to manage. Similarly, the built-in LE is just icing on the cake as it's one less thing to think about. Once https://github.com/hassio-addons/addon-tailscale/pull/89 is merged, running Home Assistant on a VPN with a LE certificate, would be such a quick setup for anyone.

Indeed, you can do all that yourself as you point out. Just last night I manually created a public domain to point to a ZeroTier address and ran the Lets Encrypt addon in Home Assistant to generate a certificate via the DNS challenge. Didn't take long, but there were many steps involved (creating a Google Cloud service account and configuring everything).

There is a community-supported HomeAssistant addon which does: https://github.com/hassio-addons/addon-tailscale

Install this SSH addon: https://github.com/hassio-addons/addon-ssh

Probably easier to use the SSH & Web addon since Terminal was depreciated. It should also be in the Supervisor tab where you found Terminal. It's the replacement for Terminal and does the same things.

get the community ssh & web terminal addon

You should be able to run a custom docker container via "SSH & Web Terminal" addon (https://github.com/hassio-addons/addon-ssh). You need to disable "protected mode" in the add-on settings and restart, though.