chore: add Loupe scanner profile

[edgepillar]

Summary

• add a repository-specific Loupe scanner profile at .loupe/scanner-config.json
• cover the TypeScript application plus security-relevant operational files
• document guarded registration, baseline scans, incremental scans, and profile updates
• link the scanning guide from the main README

Scan scope

The profile selects 21 files: the 15 JavaScript/TypeScript files under the discovered application roots plus the devnet setup script, Docker and Compose definitions, Caddy configuration, and Vite configuration.

The documented initial policy intentionally uses --no-reporting, verifier routing, human approval, and no recurring schedule.

Dependency

This profile uses the per-repository scanner configuration and extra_source_paths support merged into the independent Loupe fork:

• feat: support per-repository scanner profiles loupe#1
• merge commit 5c8744c1b2823415fe851d17bae92ff8f7193a15
• full Linux workspace validation passed on the fork's main branch

Validation

• npm run typecheck
• npm run build
• profile JSON and all seven configured paths validated
• source-discovery harness against this profile (18 tests passed and exactly 21 files selected)
• git diff --check

No credentials, wallet material, operator secrets, or reporting tokens are included.