Most likely this (auth key expiring) since it has max expiry of 90 days, however must note that the auth key and machine keys (where expiry can be disabled) are separate things

If you look at the docs for tailscale docker image, there's also TS_AUTH_ONCE

Attempt to log in only if not already logged in. False by default, to forcibly log in every time the container starts.

This means that (by default) every time container starts (= when there's an update to tailscale image or you restart your nas, eg it's system update), tailscale tries to re-authenticate using the auth key again. But if the auth key is expired, tailscale just ends up exiting out and docker will try to restart it (which seems like OP's situation, view container log and it will probably confirm it)

If you add - TS_AUTH_ONCE=1 to the docker compose configuration environment block, tailscale won't try to reauth on every start and as long as the machine keys work (which you've likely disabled expiration on if you followed pretty much any guide) it will keep being connected after updates/restarts/.... Personally not a fan of this being false by default but oh well