docs: document configurable endpoints and security headers

[0xFelix]

Summary

• Add Enabled endpoints section explaining the endpoints config key and ENDPOINTS env var (comma-separated, listing any disables all others)
• Add Security headers section listing the four headers set on all responses
• Update config file example to include endpoints block
• Add ENDPOINTS row to the environment variables table

Test plan

• Review README renders correctly on GitHub
• Verify endpoint names and header values match the code

🤖 Generated with Claude Code