0dd6a460b4
Security headers and setup-token docs were already decided but had no concrete implementation phase; also mark A.1 rate-limit and CI test workflow as done since they landed in recent commits.