docs: add Tailscale and ngrok setup for phone/tablet access

docs.json

@@ -223,6 +223,7 @@
             ]
           },
           "openhands/usage/agent-canvas/customize-and-settings",
+          "openhands/usage/agent-canvas/mobile-access",
           "openhands/usage/agent-canvas/acp-agents",
           "openhands/usage/agent-canvas/development",
           "openhands/usage/agent-canvas/troubleshooting"

openhands/usage/agent-canvas/mobile-access.mdx

@@ -0,0 +1,41 @@
+---
+title: Phone & Tablet Access
+description: Access Agent Canvas from a phone or tablet using Tailscale or ngrok.
+---
+
+If Agent Canvas is running on a Mac or Linux machine, you can access it from a phone, tablet, or any other device — without exposing anything to the public internet.
+
+## Tailscale (Recommended)
+
+[Tailscale](https://tailscale.com/) creates a private network between your devices. No port forwarding, no DNS, no firewall rules.
+
+### Setup
+
+1. Install [Tailscale](https://tailscale.com/download) on both your computer and your phone/tablet.
+2. Sign in with the same account on both devices.
+3. Find your computer's Tailscale IP (shown in the Tailscale app — typically `100.x.y.z`).
+4. Start Agent Canvas on your computer:
+   ```bash
+   agent-canvas
+   ```
+5. Open `http://<tailscale-ip>:8000/` in your phone's browser.
+
+That's it. The connection is encrypted and only your Tailscale devices can reach it.
+
+<Tip>
+**Stale browser data:** if you previously accessed Agent Canvas from the same browser on a different address (e.g. `localhost`), clear the site's localStorage first. The stored backend configuration may point at `127.0.0.1`, which is localhost *on your phone*, not your computer. You can also edit the backend URL in **Manage Backends** to use the Tailscale IP.
+</Tip>
+
+## ngrok (Remote / Public Access)
+
+If you need access from outside your local network, [ngrok](https://ngrok.com/) creates a secure tunnel with a public URL:
+
+```bash
+ngrok http 8000
+```
+
+<Warning>
+When exposing Agent Canvas over the internet, always use authentication. Run with `--public` and set `LOCAL_BACKEND_API_KEY` — see [VM / Self-Hosted Backend](/openhands/usage/agent-canvas/backend-setup/vm). Without authentication, anyone with the URL can use your instance and the LLM API keys configured in it.
+</Warning>
+
+ngrok supports OAuth, IP allowlists, and other access controls for additional security.