refactor: move vpn-only middleware from falcon.yaml to security.yaml

falcon-vpn-only was defined inline in falcon.yaml even though it's a
generic ipAllowList restriction with nothing falcon-specific about it
- security.yaml is where the other reusable middlewares (security-
headers, no-index, rate-limit) already live. Renamed to vpn-only to
match their bare naming style now that it's not tied to one file, and
updated falcon.yaml's two router references to vpn-only@file (same
cross-file pattern already used there for security-headers@file).

Also applies it to the pulsenode stack: it's a dashboard surfacing
container names/health for every service here, and there's no auth in
front of it yet, so gating it to the tailnet is a real mitigation for
that gap rather than leaving it open on the public hostname.

pulsenode/compose.yml

@@ -30,12 +30,12 @@ services:
       - "traefik.enable=true"
       - "traefik.http.routers.pulsenode-web.rule=Host(`${TRAEFIK_HOST}`)"
       - "traefik.http.routers.pulsenode-web.entrypoints=web"
-      - "traefik.http.routers.pulsenode-web.middlewares=pulsenode-redirect-web-secure"
+      - "traefik.http.routers.pulsenode-web.middlewares=vpn-only@file,pulsenode-redirect-web-secure"
       - "traefik.http.middlewares.pulsenode-redirect-web-secure.redirectscheme.scheme=https"
       - "traefik.http.routers.pulsenode-web-secure.rule=Host(`${TRAEFIK_HOST}`)"
       - "traefik.http.routers.pulsenode-web-secure.entrypoints=web-secure"
       - "traefik.http.routers.pulsenode-web-secure.tls.certresolver=resolver"
-      - "traefik.http.routers.pulsenode-web-secure.middlewares=security-headers@file,no-index@file"
+      - "traefik.http.routers.pulsenode-web-secure.middlewares=vpn-only@file,security-headers@file,no-index@file"
       - "traefik.http.services.pulsenode-web-secure.loadbalancer.server.port=3000"
       - "traefik.docker.network=${NETWORK_NAME}"
     networks: