feat: add dual Tailscale/Headscale serve support + template improvements

- Add serve.json (Tailscale with certs) and serve.headscale.json (Headscale/HTTP-only)
- Pin Vikunja to v0.24
- Improve .env.example with comments
- Harden .gitignore (env, keys, Tailscale state)
- Add SECURITY.md
- Update README with configuration and usage instructions
- Remove all damconsulting references for generic template use

SECURITY.md

@@ -0,0 +1,21 @@
+# Security Notes
+
+## Sensitive Files
+
+- `.env` — Contains your Tailscale/Headscale auth key and service configuration. **Never commit this file.**
+- `tailscale/tailscale-data/` — Contains Tailscale node state and keys. **Never commit this directory.**
+
+## Capabilities
+
+This compose file adds the following capabilities to the Tailscale sidecar:
+
+- `net_admin` — Required for Tailscale to manage network interfaces and routes.
+
+These capabilities are necessary for Tailscale to function but increase the attack surface if the container is compromised.
+
+## Recommendations
+
+- Use a dedicated, limited-scope auth key for each service.
+- Regularly rotate auth keys.
+- Review Headscale/Tailscale ACLs to ensure services only have the access they need.
+- Keep the Tailscale Docker image reasonably up to date.