Add SECURITY.md

[nora-weisser]

Goal

Add a SECURITY.md describing how to report vulnerabilities responsibly.

Scope

Create SECURITY.md at repo root:

• How to report a vulnerability privately.
• Reinforce that credentials live only in a local tests/.env (never committed).

Acceptance criteria

• SECURITY.md exists at repo root
• Private reporting channel is documented