Maity: Board

docs: write docs/security.md (threat model, credentials, replay protection)

tsk-696m4hqngc0g proposed

From TASKS.md, removed in #1065. docs/architecture.md still says a separate security document is planned. It should cover the threat model, credentials, request signing and replay protection, the stored-verifier cost, and the access-log rule (codes and credentials never in URLs).