docs: move the accepted security risks into docs/security.md

The plan holds undone work; an accepted risk is a decision, not a task
— it has no place in a queue, only a condition for revisiting it. Both
risks (POST with neither Sec-Fetch-Site nor Origin, no session-bound
CSRF tokens) move verbatim into a new docs/security.md, which also
states where D.5 findings land. Section letters and item numbering in
the plan stay as they were, since progress.md and the commit history
reference them; a note in their place points at the new file.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -10,8 +10,9 @@ signing, and is configured once through the panel. It is **outbound only** — i
 does not receive mail, provide mailboxes, or offer webmail.
 
 > **Status: under active development.** See [docs/specification.md](docs/specification.md)
-> for the full requirements and [docs/implementation-plan.md](docs/implementation-plan.md)
-> for the phased build plan.
+> for the full requirements, [docs/implementation-plan.md](docs/implementation-plan.md)
+> for the phased build plan, and [docs/security.md](docs/security.md) for the
+> security trade-offs that were accepted knowingly.
 
 ## Requirements (site checklist)