feat(traefik,headscale): restrict falcon.pivoine.art to Tailscale mesh only

Add a Traefik IP allowlist so *.falcon.pivoine.art rejects any source
outside the Tailscale/Headscale CIDR ranges, even though DNS still
resolves publicly. Pair it with a headscale MagicDNS override so
tailnet clients resolve the hostname straight to the VPS's tailscale
IP and route correctly.

Requires Docker's userland-proxy disabled on the VPS host
(/etc/docker/daemon.json) so Traefik sees real client source IPs
instead of the docker bridge gateway — done manually, not tracked
in this repo.

traefik/dynamic/falcon.yaml

@@ -11,6 +11,15 @@ http:
     triggershell-redirect-web-secure:
       redirectScheme:
         scheme: https
+    # Only let traffic through whose source IP is inside the Tailscale/Headscale
+    # mesh (100.64.0.0/10, fd7a:115c:a1e0::/48). Public DNS still resolves these
+    # hostnames, but anyone reaching them over the open internet gets a 403 —
+    # this range is only reachable by actually being a peer on the tailnet.
+    falcon-vpn-only:
+      ipAllowList:
+        sourceRange:
+          - "100.64.0.0/10"
+          - "fd7a:115c:a1e0::/48"
 
   routers:
     triggershell-web:
@@ -18,6 +27,7 @@ http:
       entrypoints:
         - web
       middlewares:
+        - falcon-vpn-only
         - triggershell-redirect-web-secure
       service: triggershell
 
@@ -28,6 +38,7 @@ http:
       tls:
         certResolver: resolver
       middlewares:
+        - falcon-vpn-only
         - security-headers@file
       service: triggershell