fix: correct serve config assignment and clean up README

- serve.json: now uses ${TS_CERT_DOMAIN} with 443 (Tailscale default)
- serve.headscale.json: uses hardcoded example domain (Headscale)
- README: replace all {{service}} placeholders with vikunja
- Update logo to selfh.st icon
- Harden .gitignore

.gitignore

@@ -1,14 +1,17 @@
-# Environment and secrets
+# Real environment files (never commit)
 .env
-.env.*
+.env.local
+.env.*.local
+
+# Secrets and keys
 *.key
 tskey-*
 authkey*
 
-# Tailscale state (never commit)
+# Tailscale state
 tailscale/tailscale-data/
 
-# OS / editor files
+# OS / editor
 .DS_Store
 *.swp
 *.swo