…eat model

Three new/updated user-facing security docs aimed at OSS auditors and
researchers:

- SECURITY.md (rewrite): private vulnerability reporting via GitHub
  advisories; safe-harbor language; explicit in/out of scope; clear
  triage timelines and credit policy.
- docs/operations/security-architecture.md (new): components, crypto
  primitives + parameters, auth/authz model, network exposure,
  outbound-traffic surfaces, validation pipelines, audit/logging,
  DoS controls, build pipeline, recommended audit entry points,
  documented design trade-offs.
- docs/operations/threat-model.md (new): trust principals, in-scope
  adversaries, explicit out-of-scope adversaries, ASCII boundary
  diagram, six documented design trade-offs (super_admin = host root,
  master_secret single-root-of-trust, recipes TOFU, audit operator-
  trust, tls.mode off permitted, unsigned release artifacts), and a
  list of cross-cutting invariants a researcher should expect to
  verify.

The Operations sidebar autogenerates so no astro.config edit is needed.
Care taken to describe the design at the level a researcher needs
without giving attackers a roadmap: parameters and primitives are
listed, but specific bypass techniques and unfixed weaknesses are not.