chore: replace stale draft with canonical ts-TEMPLATE form for ts-homepage

- Replace alternate template form (with {{YOUR_TAILSCALE_AUTHKEY}}, sys_module
  cap, hardcoded homepage.damconsulting.net serve.json) with the canonical
  ts-TEMPLATE pattern: Tailscale sidecar + Homepage, both via network_mode
- Use named volume for config dir; default settings/services/bookmarks/widgets
  files included as starting points for the user to customize
- Add SECURITY.md and proper .gitignore (incl. Homepage's auto-generated
  custom.css/custom.js/docker.yaml/kubernetes.yaml/proxmox.yaml stubs +
  logs/)
- serve.headscale.json now uses the actual MagicDNS base domain
  (homepage.damconsulting.net) so the user has a working starting point
  to edit, not a {{service}} placeholder that doesn't resolve
- Verified: dashboard renders at homepage.damconsulting.net

docker-compose.yml

@@ -1,31 +1,39 @@
+# ==========================================
+# REQUIRED: Tailscale sidecar (all ts-* services)
+# ==========================================
 services:
   homepage-ts:
     image: tailscale/tailscale:latest
     hostname: homepage
     container_name: homepage-ts
     environment:
-      - TS_AUTHKEY={{YOUR_TAILSCALE_AUTHKEY}}
+      - TS_AUTHKEY=${TS_AUTHKEY}
+      - TS_LOGIN_SERVER=${TS_LOGIN_SERVER}
       - TS_STATE_DIR=/var/lib/tailscale
       - TS_SERVE_CONFIG=/config/serve.json
+      - TS_EXTRA_ARGS=--login-server=${TS_LOGIN_SERVER}
     volumes:
       - ./tailscale/tailscale-data:/var/lib/tailscale
       - ./tailscale/config:/config
       - /dev/net/tun:/dev/net/tun
     cap_add:
       - net_admin
-      - sys_module
     restart: unless-stopped
+
+  # ==========================================
+  # REQUIRED: Homepage (single container, no DB)
+  # ==========================================
   homepage:
     image: ghcr.io/gethomepage/homepage:latest
-    container_name: homepage
-    # ports:
-    #   - 3000:3000
-    volumes:
-      - ./homepage/config:/app/config # Make sure your local config directory exists
-      # - /var/run/docker.sock:/var/run/docker.sock # (optional) For docker integrations
     environment:
-      # HOMEPAGE_ALLOWED_HOSTS: gethomepage.dev # required, may need port. See gethomepage.dev/installation/#homepage_allowed_hosts
-      HOMEPAGE_ALLOWED_HOSTS: "*" # required, may need port. See gethomepage.dev/installation/#homepage_allowed_hosts
+      # Required: comma-separated list of allowed hostnames / IPs.
+      # Use "*" to allow any (fine behind Tailscale, since Tailscale handles auth).
+      HOMEPAGE_ALLOWED_HOSTS: "*"
+      TZ: ${TZ:-UTC}
+    volumes:
+      - ./homepage/config:/app/config
+    depends_on:
+      - homepage-ts
     network_mode: service:homepage-ts
-    depends_on: 
-      - homepage-ts
+    restart: unless-stopped
+