chore: replace stale draft with canonical ts-TEMPLATE form for ts-homepage

- Replace alternate template form (with {{YOUR_TAILSCALE_AUTHKEY}}, sys_module
  cap, hardcoded homepage.damconsulting.net serve.json) with the canonical
  ts-TEMPLATE pattern: Tailscale sidecar + Homepage, both via network_mode
- Use named volume for config dir; default settings/services/bookmarks/widgets
  files included as starting points for the user to customize
- Add SECURITY.md and proper .gitignore (incl. Homepage's auto-generated
  custom.css/custom.js/docker.yaml/kubernetes.yaml/proxmox.yaml stubs +
  logs/)
- serve.headscale.json now uses the actual MagicDNS base domain
  (homepage.damconsulting.net) so the user has a working starting point
  to edit, not a {{service}} placeholder that doesn't resolve
- Verified: dashboard renders at homepage.damconsulting.net

tailscale/config/serve.json

@@ -1,19 +1,29 @@
 {
-    "TCP": {
-      "443": {
-        "HTTPS": true
-      }
+  "TCP": {
+    "80": {
+      "HTTP": true
     },
-    "Web": {
-      "${TS_CERT_DOMAIN}:443": {
-        "Handlers": {
-          "/": {
-            "Proxy": "http://127.0.0.1:3000"
-          }
+    "443": {
+      "HTTPS": true
+    }
+  },
+  "Web": {
+    "${TS_CERT_DOMAIN}:80": {
+      "Handlers": {
+        "/": {
+          "Proxy": "http://127.0.0.1:3000"
         }
       }
     },
-    "AllowFunnel": {
-      "${TS_CERT_DOMAIN}:443": false
+    "${TS_CERT_DOMAIN}:443": {
+      "Handlers": {
+        "/": {
+          "Proxy": "http://127.0.0.1:3000"
+        }
+      }
     }
-  }
+  },
+  "AllowFunnel": {
+    "${TS_CERT_DOMAIN}:443": false
+  }
+}