feat(traefik,headscale): restrict falcon.pivoine.art to Tailscale mesh only

Add a Traefik IP allowlist so *.falcon.pivoine.art rejects any source
outside the Tailscale/Headscale CIDR ranges, even though DNS still
resolves publicly. Pair it with a headscale MagicDNS override so
tailnet clients resolve the hostname straight to the VPS's tailscale
IP and route correctly.

Requires Docker's userland-proxy disabled on the VPS host
(/etc/docker/daemon.json) so Traefik sees real client source IPs
instead of the docker bridge gateway — done manually, not tracked
in this repo.

headscale/config.yaml

@@ -57,6 +57,14 @@ dns:
       - 1.1.1.1
       - 1.0.0.1
   search_domains: []
+  # Served only to tailnet clients via MagicDNS: overrides falcon.pivoine.art
+  # app hostnames to resolve to the VPS's tailscale IP instead of its public
+  # one, so VPN-connected clients route straight over the tunnel and satisfy
+  # Traefik's falcon-vpn-only IP allowlist.
+  extra_records:
+    - name: "triggershell.falcon.pivoine.art"
+      type: "A"
+      value: "100.64.0.3"
 
 # TLS is terminated by Traefik; headscale itself serves plain HTTP internally.
 tls_letsencrypt_hostname: ""