headscale: fix config schema, DERP map, and UI routing; document setup

- config.yaml: migrate to current headscale config schema (database/dns
  nested keys instead of legacy db_type/db_path/dns_config), add noise
  private key path, prefixes, and a DERP map (required at startup)
- compose.yaml: bind-mount a fixed Caddyfile for headscale-ui so it
  serves from /app/admin instead of 404ing at /app
- README: document NPM reverse proxy setup (websockets on, HTTP/2 off
  to avoid breaking the ts2021 noise protocol handshake), split
  Android/iOS vs laptop client instructions, add headscale-ui admin
  panel setup with API key generation, switch CLI examples to
  docker exec against the running container

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

headscale_dev/compose.yaml

@@ -18,6 +18,8 @@ services:
   headscale-ui:
     image: ${HEADSCALE_UI_IMAGE:-goodieshq/headscale-admin:latest}
     restart: ${HEADSCALE_UI_RESTART:-unless-stopped}
+    volumes:
+      - ${VOL_PATH:-/data}/headscale/config/Caddyfile:/etc/caddy/Caddyfile:ro
     environment:
       - TZ=${TZ:-America/Vancouver}
       - HEADSCALE_URL=http://headscale:8080