feat: improve template structure and documentation

- Add dual serve config (serve.json + serve.headscale.json)
- Add SECURITY.md with default passwords warning
- Add .env.example with clear REQUIRED / REFERENCE / CUSTOMIZE sections
- Rewrite README with clear Tailscale vs Headscale paths
- Harden .gitignore (env files, keys, Tailscale state)
- Update docker-compose.yml with clear section labels
- Make volume names service-specific ({{service}}-db-data)
- Ensure both db and app services depend on the Tailscale sidecar

tailscale/config/serve.json

@@ -1,19 +1,29 @@
 {
-    "TCP": {
-      "443": {
-        "HTTPS": true
-      }
+  "TCP": {
+    "80": {
+      "HTTP": true
     },
-    "Web": {
-      "${TS_CERT_DOMAIN}:443": {
-        "Handlers": {
-          "/": {
-            "Proxy": "http://127.0.0.1:3000"
-          }
+    "443": {
+      "HTTPS": true
+    }
+  },
+  "Web": {
+    "${TS_CERT_DOMAIN}:80": {
+      "Handlers": {
+        "/": {
+          "Proxy": "http://127.0.0.1:{{port}}"
         }
       }
     },
-    "AllowFunnel": {
-      "${TS_CERT_DOMAIN}:443": false
+    "${TS_CERT_DOMAIN}:443": {
+      "Handlers": {
+        "/": {
+          "Proxy": "http://127.0.0.1:{{port}}"
+        }
+      }
     }
-  }
+  },
+  "AllowFunnel": {
+    "${TS_CERT_DOMAIN}:443": false
+  }
+}