Skerry Sync: new service

[IFindMe]

Adds services/skerry-sync/ from templates/service-template:

• secherkasov/skerry-sync:latest, internal port 8080, Tailnet-only (Serve proxies https://<host>.<tailnet>.ts.net to http://127.0.0.1:8080).
• SQLite default (./skerry-sync-data/data:/data, image runs as 999:999); PostgreSQL intentionally not wired in.
• SKERRY_JWT_SECRET required with placeholder safe value; SKERRY_ADMIN_TOKEN empty closes /console and /admin/*.
• App healthcheck not overridden: image defines HEALTHCHECK (wget -qO- http://localhost:8080/healthz).
• Service README documents secrets setup, 999:999 pre-create, Tailnet URLs (/, /account, /console), and TLS-via-Serve.
• Root README.md: Skerry Sync row under Productivity and Collaboration (alphabetized).

Related Issues

• None.

Verification

• docker compose config --quiet in services/skerry-sync: PASS.
• git diff --check: PASS.
• rumdl check --config .markdownlint.yml README.md services/skerry-sync/README.md: not run, rumdl not installed.
• Live stack start + Tailnet reachability (/, /account, /console, app register/sync, persistence): not run, needs TS_AUTHKEY and Tailnet access.

Checklist

• I have performed a self-review of my code and followed the templates structure.
• I have added verification that the stack works as expected.
• I have updated necessary documentation (e.g. frontpage README.md ).
• I have selected the correct label(s) for this PR.

Additional Context

• Upstream treats trusted-LAN cleartext as acceptable (E2E-encrypted payload), but requires a TLS terminator off-host; here Tailscale Serve provides that HTTPS layer.
• Upstream refs: server README, guide, image.
• Note: pushed commit c9541bd is currently on main of the fork; open the PR from that branch.