feat: bring ts-bookstack up to current template spec

- Add SECURITY.md (matches template)
- Add tailscale/config/serve.headscale.json (HTTP-only variant)
- Default serve.json to Tailscale generic with ${TS_CERT_DOMAIN}
- Use linuxserver env var names (DB_USERNAME not DB_USER)
- Use named Docker volumes for cross-platform portability
- Both db and app use network_mode: service:bookstack-ts
- Rewrite README with Tailscale vs Headscale structure
- Rename db service to bookstack-db to avoid collisions with other ts-* repos

tailscale/config/serve.headscale.json

@@ -0,0 +1,16 @@
+{
+  "TCP": {
+    "80": {
+      "HTTP": true
+    }
+  },
+  "Web": {
+    "bookstack.example.com:80": {
+      "Handlers": {
+        "/": {
+          "Proxy": "http://127.0.0.1:80"
+        }
+      }
+    }
+  }
+}

tailscale/config/serve.json

@@ -1,19 +1,29 @@
 {
-    "TCP": {
-      "443": {
-        "HTTPS": true
-      }
+  "TCP": {
+    "80": {
+      "HTTP": true
     },
-    "Web": {
-      "${TS_CERT_DOMAIN}:443": {
-        "Handlers": {
-          "/": {
-            "Proxy": "http://127.0.0.1:3000"
-          }
+    "443": {
+      "HTTPS": true
+    }
+  },
+  "Web": {
+    "${TS_CERT_DOMAIN}:80": {
+      "Handlers": {
+        "/": {
+          "Proxy": "http://127.0.0.1:80"
         }
       }
     },
-    "AllowFunnel": {
-      "${TS_CERT_DOMAIN}:443": false
+    "${TS_CERT_DOMAIN}:443": {
+      "Handlers": {
+        "/": {
+          "Proxy": "http://127.0.0.1:80"
+        }
+      }
     }
-  }
+  },
+  "AllowFunnel": {
+    "${TS_CERT_DOMAIN}:443": false
+  }
+}