refactor: move vpn-only middleware from falcon.yaml to security.yaml

falcon-vpn-only was defined inline in falcon.yaml even though it's a
generic ipAllowList restriction with nothing falcon-specific about it
- security.yaml is where the other reusable middlewares (security-
headers, no-index, rate-limit) already live. Renamed to vpn-only to
match their bare naming style now that it's not tied to one file, and
updated falcon.yaml's two router references to vpn-only@file (same
cross-file pattern already used there for security-headers@file).

Also applies it to the pulsenode stack: it's a dashboard surfacing
container names/health for every service here, and there's no auth in
front of it yet, so gating it to the tailnet is a real mitigation for
that gap rather than leaving it open on the public hostname.

traefik/dynamic/security.yaml

@@ -44,3 +44,12 @@ http:
         average: 30
         burst: 15
         period: 1s
+    # Only let traffic through whose source IP is inside the Tailscale/Headscale
+    # mesh (100.64.0.0/10, fd7a:115c:a1e0::/48). Public DNS can still resolve
+    # these hostnames, but anyone reaching them over the open internet gets a
+    # 403 — this range is only reachable by actually being a peer on the tailnet.
+    vpn-only:
+      ipAllowList:
+        sourceRange:
+          - "100.64.0.0/10"
+          - "fd7a:115c:a1e0::/48"