I too have no idea what this is about. I never used tailscale, and I have no idea what immich is.
But perhaps your problem is that the app expects to be on the root? Perhaps that could be a problem. Can you instead do another sub-domain level like immich.pcname.tail$$$$$.ts.net? Or does the app (immich) allow you to set URL root?
Anyway, seems that may indeed be the issue, and also that tailscale cannot do those sub-domains as I thought based on the discussion I found. It seems this is the same issue: https://github.com/immich-app/immich/discussions/1679
And someone probably has a solution: https://gist.github.com/aveexy/4b2b22b2198636b0a91c7c142ec11b37
Again, I have no idea what Immich even is in the first place, Tailscale, I just know it exists. Consider me about as useful as AI, I just did some googling, with only prior info being that I had to set base URL in both kiwix-serve and Navidrome for them to work properly under a directory or whatever the part after slash is called.
Don’t worry, it’s probably going to be even more locked down.
I miss Android 7 and prior. The only improvement I see is permission management and UI on tablets (dp >= 600). And perhaps app updates without prompting user from 3rd party app stores (like F-Droid), but I don’t like automatic updates anyway.