feat: improve template structure and documentation

- Add dual serve config (serve.json + serve.headscale.json)
- Add SECURITY.md with default passwords warning
- Add .env.example with clear REQUIRED / REFERENCE / CUSTOMIZE sections
- Rewrite README with clear Tailscale vs Headscale paths
- Harden .gitignore (env files, keys, Tailscale state)
- Update docker-compose.yml with clear section labels
- Make volume names service-specific ({{service}}-db-data)
- Ensure both db and app services depend on the Tailscale sidecar

.env.example

@@ -0,0 +1,38 @@
+# ==========================================
+# REQUIRED: Tailscale / Headscale (all ts-* services)
+# ==========================================
+
+# Your Tailscale or Headscale auth key
+TS_AUTHKEY=***
+
+# Tailscale control server (default)
+# For Headscale: update to your Headscale server URL
+TS_LOGIN_SERVER=https://controlplane.tailscale.com
+
+# ==========================================
+# REFERENCE: Database credentials (only if your service uses an external DB)
+# Remove this section if your service uses SQLite or has no database
+# ==========================================
+
+POSTGRES_USER={{service}}
+POSTGRES_PASSWORD=***
+POSTGRES_DB={{service}}
+
+# ==========================================
+# CUSTOMIZE: App-specific variables (replace with what your service needs)
+# ==========================================
+
+# Public URL users will access the service at
+# Tailscale example: https://{{service}}.your-tailnet.ts.net
+# Headscale example: http://{{service}}.yourdomain.com
+{{SERVICE}}_SERVICE_PUBLICURL=http://{{service}}.example.com
+
+# Frontend URL (usually the same as PUBLICURL)
+{{SERVICE}}_SERVICE_FRONTENDURL=http://{{service}}.example.com
+
+# Service JWT secret (change this!)
+{{SERVICE}}_SERVICE_JWTSECRET=***
+
+# Add more app-specific vars here as needed, for example:
+# {{SERVICE}}_TIMEZONE=UTC
+# {{SERVICE}}_ADMIN_EMAIL=admin@example.com