chore: replace stale draft with canonical ts-TEMPLATE form for ts-focalboard

- Replace alternate template form (with {{YOUR_TAILSCALE_AUTHKEY}}, sys_module
  cap, {{service-compose}} placeholder) with the canonical ts-TEMPLATE pattern:
  Tailscale sidecar + Focalboard, both via network_mode namespace
- Use SQLite by default (Focalboard's stock behavior); Postgres mode
  documented in README with config.json mount instructions
- Pin to mattermost/focalboard:7.11.4
- Add SECURITY.md and proper .gitignore (incl. focalboard/config.json
  exclude so Postgres config files stay out of repo)
- Note: official Focalboard image is amd64-only; runs via emulation
  on arm64 hosts (Apple Silicon)
- Verified: setup wizard renders, first-time account creation works

docker-compose.yml

@@ -1,21 +1,38 @@
+# ==========================================
+# REQUIRED: Tailscale sidecar (all ts-* services)
+# ==========================================
 services:
-  {{service}}-ts:
+  focalboard-ts:
     image: tailscale/tailscale:latest
-    hostname: {{service}}
-    container_name: {{service}}-ts
+    hostname: focalboard
+    container_name: focalboard-ts
     environment:
-      - TS_AUTHKEY={{YOUR_TAILSCALE_AUTHKEY}}
+      - TS_AUTHKEY=${TS_AUTHKEY}
+      - TS_LOGIN_SERVER=${TS_LOGIN_SERVER}
       - TS_STATE_DIR=/var/lib/tailscale
       - TS_SERVE_CONFIG=/config/serve.json
+      - TS_EXTRA_ARGS=--login-server=${TS_LOGIN_SERVER}
     volumes:
       - ./tailscale/tailscale-data:/var/lib/tailscale
       - ./tailscale/config:/config
       - /dev/net/tun:/dev/net/tun
     cap_add:
       - net_admin
-      - sys_module
     restart: unless-stopped
-  {{service-compose}}
-    network_mode: service:{{service}}-ts
-    depends_on: 
-      - {{service}}-ts
+
+  # ==========================================
+  # Focalboard (SQLite by default — no separate DB service)
+  # For Postgres, see README.md "Postgres mode" section.
+  # ==========================================
+  focalboard:
+    image: mattermost/focalboard:7.11.4
+    environment: []
+    volumes:
+      - focalboard-data:/opt/focalboard/data
+    depends_on:
+      - focalboard-ts
+    network_mode: service:focalboard-ts
+    restart: unless-stopped
+
+volumes:
+  focalboard-data: