docs: add security policy

A public repository with no stated disclosure channel routes a finder into
opening a public issue, which discloses a relay flaw to everyone the moment it
is filed. SECURITY.md points at the repository private vulnerability reporting
instead, with public@mixeme.ru as fallback, and states scope so operator-side
configuration (blocked port 25, missing PTR, proxy TLS) does not arrive as a
report.

No response time is promised: a deadline that cannot be honoured by a single
maintainer is worse than none. Silence is explicitly not a request for a
continued embargo.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,14 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ## [Unreleased]
 
+### Added
+
+- `SECURITY.md` — how to report a vulnerability privately (GitHub private
+  vulnerability reporting, `public@mixeme.ru` as fallback), which releases get
+  fixes, and what is in and out of scope for a relay. No response time is
+  promised. Without it a finder's default move is a public issue, which
+  discloses a relay flaw to everyone the moment it is filed.
+
 ### Changed
 
 - The panel's **Account** entry is now called **Settings** — nav link, page