Security overview placeholder

This starter preserves structural safeguards and deployment discipline, but it avoids claiming controls that depend on a real operating environment.

The baseline includes conservative headers, localized metadata, consent handling, a local-only demo, and Cloudflare-compatible build output. It does not yet promise incident response, rate limiting, monitoring, or vendor review coverage.

Once the final product stack is chosen, this page should be updated with concrete controls for secrets handling, access management, logging, vendor review, backups, and operational ownership.