docs: add the security review summary

Covers all 24 findings fixed across the four commits on this branch, with the
attack path and the reasoning for each, plus eight issues reported and
deliberately left alone because they need a product or deployment decision
rather than a patch.

Two things the document is careful about. It records what was checked and
found sound, which is half of what a review is for - and several of those
were places the obvious guess would have been wrong. And it is explicit about
its own limits: no running instance, no database, no browser, no CVE scan,
and machine verdicts that ran against already-patched code, so their
"refuted" is not evidence of anything.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014QtoqPREn6SsE5M4oFnQH5

Author: claude