fix(compose): exec-form healthcheck; enable embedded DERP (tw)

- healthcheck 改 exec 形式（distroless 映像無 /bin/sh，CMD-SHELL 永遠 unhealthy）
- 補 command: serve、對外開 3478/udp（DERP STUN）
- config.yaml 內建 DERP 設為 enabled（region tw），與線上實跑一致

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.yml

@@ -1,9 +1,8 @@
 services:
   headscale:
-    # 釘版本避免 watchtower 自動套用破壞性更新（見 OPERATIONS.md → 故障排除）。
-    # 升級時手動改 tag 並先看 CHANGELOG 的 BREAKING 段落。
     image: headscale/headscale:v0.29.0
     container_name: headscale
+    command: serve
     restart: unless-stopped
     networks:
       - shared-net
@@ -14,7 +13,7 @@ services:
 
     # 健康檢查
     healthcheck:
-      test: ["CMD-SHELL", "headscale version >/dev/null 2>&1 || exit 1"]
+      test: ["CMD", "headscale", "version"]
       interval: 30s
       timeout: 10s
       retries: 3
@@ -38,6 +37,7 @@ services:
       - "8080:8080"    # HTTP API
       - "9090:9090"    # Metrics
       - "50443:50443"  # gRPC
+      - "3478:3478/udp" # DERP STUN
 
     # 標籤配置
     labels: