[P0] Add a security disclosure and vulnerability response policy

[Calebux]

Summary

The repo contains payment, auth, and blockchain code and needs a formal reporting path.

Scope

• Area: governance
• Priority: P0
• Backlog ID: #117

Acceptance Criteria

• Private disclosure channel is documented.
• Response timeline and severity handling are defined.
• Policy is linked from README and issue templates.

Implementation Notes

• Keep the implementation aligned with current architecture decisions and security constraints in this repo.
• Include tests for changed behavior and update docs where relevant.

Definition of Done

• Acceptance criteria met
• Tests added/updated and passing
• Documentation updated
• No security regressions introduced

Links

• Backlog source: docs/repo-issue-backlog-2026-05.md