6fe333204b
Security headers and setup-token docs were already decided but had no concrete implementation phase; also mark A.1 rate-limit and CI test workflow as done since they landed in recent commits.