feat: bring ts-bookstack up to current template spec

- Add SECURITY.md (matches template)
- Add tailscale/config/serve.headscale.json (HTTP-only variant)
- Default serve.json to Tailscale generic with ${TS_CERT_DOMAIN}
- Use linuxserver env var names (DB_USERNAME not DB_USER)
- Use named Docker volumes for cross-platform portability
- Both db and app use network_mode: service:bookstack-ts
- Rewrite README with Tailscale vs Headscale structure
- Rename db service to bookstack-db to avoid collisions with other ts-* repos

docker-compose.yml

@@ -1,21 +1,60 @@
 services:
-  {{service}}-ts:
+  bookstack-ts:
     image: tailscale/tailscale:latest
-    hostname: {{service}}
-    container_name: {{service}}-ts
+    hostname: bookstack
+    container_name: bookstack-ts
     environment:
-      - TS_AUTHKEY={{YOUR_TAILSCALE_AUTHKEY}}
+      - TS_AUTHKEY=${TS_AUTHKEY}
+      - TS_LOGIN_SERVER=${TS_LOGIN_SERVER}
       - TS_STATE_DIR=/var/lib/tailscale
       - TS_SERVE_CONFIG=/config/serve.json
+      - TS_EXTRA_ARGS=--login-server=${TS_LOGIN_SERVER}
     volumes:
       - ./tailscale/tailscale-data:/var/lib/tailscale
       - ./tailscale/config:/config
       - /dev/net/tun:/dev/net/tun
     cap_add:
       - net_admin
-      - sys_module
     restart: unless-stopped
-  {{service-compose}}
-    network_mode: service:{{service}}-ts
-    depends_on: 
-      - {{service}}-ts
+
+  bookstack-db:
+    image: lscr.io/linuxserver/mariadb:latest
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=UTC
+      - MYSQL_ROOT_PASSWORD=${DB_ROOT_PASSWORD}
+      - MYSQL_DATABASE=${DB_DATABASE}
+      - MYSQL_USER=${DB_USERNAME}
+      - MYSQL_PASSWORD=${DB_PASSWORD}
+    volumes:
+      - bookstack-db-data:/config
+    depends_on:
+      - bookstack-ts
+    network_mode: service:bookstack-ts
+    restart: unless-stopped
+
+  bookstack:
+    image: lscr.io/linuxserver/bookstack:latest
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=UTC
+      - APP_URL=${APP_URL}
+      - APP_KEY=${APP_KEY}
+      - DB_HOST=127.0.0.1
+      - DB_PORT=3306
+      - DB_USERNAME=${DB_USERNAME}
+      - DB_PASSWORD=${DB_PASSWORD}
+      - DB_DATABASE=${DB_DATABASE}
+    volumes:
+      - bookstack-data:/config
+    depends_on:
+      - bookstack-ts
+      - bookstack-db
+    network_mode: service:bookstack-ts
+    restart: unless-stopped
+
+volumes:
+  bookstack-db-data:
+  bookstack-data: