feat: Refactor Tailscale & Traefik Integration

- Integrate Traefik directly with Tailscale network using `network_mode: service:tailscale`.
- Remove direct port mappings for Traefik (80, 443).
- Configure Tailscale container to use `tailscale serve` (Tailnet only) or `tailscale funnel` (public HTTPS) based on `ENABLE_FUNNEL_HTTPS` env var.
- Update Traefik routing rules (`Host()`) to use `${TAILSCALE_HOSTNAME}.${TAILSCALE_TAILNET_DOMAIN}` for all services.
- Update Homepage path to `/home` and adjust its Traefik rule.
- Remove Homepage basic authentication variables (`HOMEPAGE_AUTH_USER`, `HOMEPAGE_AUTH_HASH`) from `.env.example` and `README.md`.
- Update `README.md` to reflect new access methods, hostname configuration, and removal of basic auth.
- Add `extra_hosts` to Tailscale service for `host.docker.internal`.

README.md

@@ -86,7 +86,7 @@ These are fundamental for basic operation and permissions.
     *   **Note:** Using the correct IDs is crucial for file permissions, especially for accessing media files on the host.
 *   `TIMEZONE`: Your local timezone (e.g., `America/New_York`, `Europe/London`, `Asia/Manila`). Find yours from [this list](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones).
     *   *Default:* `America/New_York`
-*   `HOSTNAME`: The primary hostname or IP address you intend to use to access your services. Traefik uses this for routing. Can be a local IP or a fully qualified domain name (e.g., `tailscale-nas.your-tailnet.ts.net`).
+*   `HOSTNAME`: **(Deprecated - Now derived)** The primary hostname used by Traefik for routing. This is now automatically constructed from `TAILSCALE_HOSTNAME` and `TAILSCALE_TAILNET_DOMAIN`. You generally don't need to set this directly unless overriding the default behavior.
     *   *Default:* `${TAILSCALE_HOSTNAME}.${TAILSCALE_TAILNET_DOMAIN}`
 
 ---
@@ -203,18 +203,29 @@ These settings are for enabling automatic HTTPS certificate generation via Let's
 
 ## Service Access
 
-With the default Tailscale setup, services are securely accessible via HTTPS using your Tailscale node's name or IP, followed by the service path:
+With the default Tailscale setup, services are securely accessible via HTTPS using your Tailscale node's name or IP, followed by the service path. Replace `<TAILSCALE_NODE>` with your Tailscale device name (e.g., `tailscale-nas.your-tailnet.ts.net`) or its Tailscale IP address.
 
-*   **Homepage:** `https://<TAILSCALE_NODE>/`
+*   **Homepage:** `https://<TAILSCALE_NODE>/home`
 *   **Sonarr:** `https://<TAILSCALE_NODE>/sonarr`
 *   **Radarr:** `https://<TAILSCALE_NODE>/radarr`
+*   **Lidarr:** `https://<TAILSCALE_NODE>/lidarr` (If profile enabled)
+*   **Bazarr:** `https://<TAILSCALE_NODE>/bazarr`
+*   **Jellyseerr:** `https://<TAILSCALE_NODE>/jellyseerr`
+*   **Prowlarr:** `https://<TAILSCALE_NODE>/prowlarr`
 *   **qBittorrent:** `https://<TAILSCALE_NODE>/qbittorrent`
+*   **SABnzbd:** `https://<TAILSCALE_NODE>/sabnzbd` (If profile enabled)
 *   **Jellyfin:** `https://<TAILSCALE_NODE>/jellyfin`
-*   ...and so on.
+*   **Calibre-Web:** `https://<TAILSCALE_NODE>/calibre` (If profile enabled)
+*   **AdGuard Home:** `http://<TAILSCALE_NODE_IP>:3000` (If profile enabled, access via IP/port initially)
+*   **Tandoor Recipes:** `https://<TAILSCALE_NODE>/recipes` (If profile enabled)
+*   **Joplin Server:** `https://<TAILSCALE_NODE>/joplin` (If profile enabled)
+*   **Home Assistant:** `http://<TAILSCALE_NODE_IP>:8123` (If profile enabled, access via IP/port initially)
+*   **Immich:** `http://<TAILSCALE_NODE_IP>:2283` (If profile enabled, access via IP/port initially)
 
-Replace `<TAILSCALE_NODE>` with your Tailscale device name (e.g., `tailscale-nas.your-tailnet.ts.net`) or its Tailscale IP address.
-
-If you configure DNS for your `HOSTNAME` variable to point to the Tailscale IP, you can use `https://<HOSTNAME>/<service_path>`.
+**Note:**
+*   `<TAILSCALE_NODE>` refers to the full Tailscale name (e.g., `tailscale-nas.your-tailnet.ts.net`).
+*   `<TAILSCALE_NODE_IP>` refers to the Tailscale IP address of the NAS.
+*   Some services (AdGuard, HA, Immich) might require initial setup via their direct IP and port before Tailscale/Traefik routing is fully effective or configured within the application. Authentication for most services will be handled by Authelia (configured later).
 
 ## Optional Services