feat: improve template structure and documentation

- Add dual serve config (serve.json + serve.headscale.json)
- Add SECURITY.md with default passwords warning
- Add .env.example with clear REQUIRED / REFERENCE / CUSTOMIZE sections
- Rewrite README with clear Tailscale vs Headscale paths
- Harden .gitignore (env files, keys, Tailscale state)
- Update docker-compose.yml with clear section labels
- Make volume names service-specific ({{service}}-db-data)
- Ensure both db and app services depend on the Tailscale sidecar

.gitignore

@@ -1,9 +1,18 @@
-# Secrets and environment files
+# Real environment files (never commit)
 .env
-.env.*
+.env.local
+.env.*.local
+
+# Secrets and keys
 *.key
 tskey-*
 authkey*
 
-# Tailscale data (never commit state)
+# Tailscale state
 tailscale/tailscale-data/
+
+# OS / editor
+.DS_Store
+*.swp
+*.swo
+*~