Security: document threat model and secure key handling

[Shreyas582]

Scope

Expand security posture documentation for practical deployment boundaries.

Acceptance Criteria

• Threat model and non-goals are documented.
• Key handling/storage recommendations are explicit.
• Side-channel caveats and deployment guidance are clearly stated.