chore: replace stale draft with canonical ts-TEMPLATE form for ts-focalboard

- Replace alternate template form (with {{YOUR_TAILSCALE_AUTHKEY}}, sys_module
  cap, {{service-compose}} placeholder) with the canonical ts-TEMPLATE pattern:
  Tailscale sidecar + Focalboard, both via network_mode namespace
- Use SQLite by default (Focalboard's stock behavior); Postgres mode
  documented in README with config.json mount instructions
- Pin to mattermost/focalboard:7.11.4
- Add SECURITY.md and proper .gitignore (incl. focalboard/config.json
  exclude so Postgres config files stay out of repo)
- Note: official Focalboard image is amd64-only; runs via emulation
  on arm64 hosts (Apple Silicon)
- Verified: setup wizard renders, first-time account creation works

SECURITY.md

@@ -0,0 +1,37 @@
+# Security Notes for ts-focalboard
+
+This repository contains the configuration for deploying Focalboard behind a Tailscale sidecar.
+
+## What's committed
+
+- `docker-compose.yml` — service definitions, image versions, env var references
+- `.env.example` — template showing required env vars (no real secrets)
+- `tailscale/config/serve.json` — Tailscale serve config (committed generic form)
+- `tailscale/config/serve.headscale.json` — Headscale variant for testing
+- `README.md` — setup instructions
+
+## What is NOT committed
+
+- `.env` — contains real authkeys, database passwords
+- `tailscale/tailscale-data/` — Tailscale node identity state
+- Any volume data
+
+The `.gitignore` at the repo root blocks accidental commits of these.
+
+## Rotation
+
+- If a `TS_AUTHKEY` was ever leaked, revoke it at https://login.tailscale.com/admin/authkeys (or your Headscale equivalent) and generate a new one.
+- The `POSTGRES_PASSWORD` in `.env` only needs rotation if the database was exposed beyond the tailnet.
+
+## Threat model
+
+This deployment assumes:
+- The Mac mini is reachable only via Tailscale/Headscale
+- All access to Focalboard goes through the Tailscale sidecar (no exposed ports)
+- The Tailnet itself is trusted
+
+If your threat model differs (e.g., you need to expose Focalboard to the public internet), review the `AllowFunnel` setting in `tailscale/config/serve.json` and the Tailscale ACL controls carefully before proceeding.
+
+## Reporting
+
+If you find a security issue with this deployment pattern, contact kevin.riordan@damconsulting.llc.