docs(zh): add Chinese remote-access guide (Tailscale, SSH tunnel, native Windows)

Companion to docs/remote-access.md for Chinese users, per the
contribution shape requested in #7393:

- Tailscale Serve preferred path (loopback + HTTPS MagicDNS), direct
  tailnet IP as fallback, SSH tunnel section
- Native Windows deployment via the official start.ps1 launcher with
  password auth; firewall rule scoped to the Tailscale CGNAT range
  (100.64.0.0/10) instead of an all-interfaces open
- Windows logon auto-start via the official
  scripts/windows/setup_webui_autostart.ps1 scheduled-task helper
- Explicit security boundary section distinguishing tailnet-private,
  LAN, and public exposure
- No machine-specific usernames/drives/model choices/popularity numbers
- Linked from the README docs index

Tests: test_readme_compat_section, test_issue3012_3006_docker_docs,
test_nix_flake_module_source all pass (17/17).

README.md

@@ -684,6 +684,7 @@ The WebUI is still coupled to Hermes Agent internals for runtime execution, prov
 
 **Deploying & operating**
 - [`docs/remote-access.md`](docs/remote-access.md) — SSH tunnel, Tailscale, and phone access (incl. a community ARM64-Android field report)
+- [`docs/remote-access-zh.md`](docs/remote-access-zh.md) — 中文远程访问指南：Tailscale、SSH 隧道、Windows 原生部署与开机自启
 - [`docs/advanced-chat-setup.md`](docs/advanced-chat-setup.md) — optional dynamic recall-prefill and Gateway-backed browser chat for self-hosted deployments
 - [`docs/docker.md`](docs/docker.md) — Docker compose setup, common failures, and bind-mount migration
 - [`docs/supervisor.md`](docs/supervisor.md) — launchd, systemd, supervisord, runit, and s6 process-supervisor setup