docs: add Web Application Firewall reference

[kriszyp]

Summary

• add a v5.2 WAF overview covering request surfaces, rule evaluation, path normalization, enforcement modes, node activation, and fail-open behavior
• document every WAF configuration option and the replicated control precedence
• document the super_user management operations, complete rule schema, examples, and v5.2 deferred fields
• add Reference, Security, Operations API, sidebar, and v5.2 release-note links

Documents harper-pro #517 - WAF component: rule-table-driven request filtering with live updates, reserved v1 schema, shadow/monitor mode, and activation gating.

Validation

• npm run format:check
• npm run typecheck
• npm run build
• parsed all 17 JSON examples
• visually checked all three WAF pages and sidebar navigation in the production build

The build succeeds with one pre-existing broken-anchor warning in the v5.1 release notes (#deployment-operations); this PR introduces no broken links or anchors.

Generated by OpenAI Codex (GPT-5.6).

[gemini-code-assist]

Code Review

This pull request introduces comprehensive documentation for the new Web Application Firewall (WAF) feature in Harper Pro (v5.2.0). It adds new reference pages covering the WAF overview, configuration options, and operations/rule schema, alongside updating the main reference index, security overview, operations API docs, release notes, and sidebar navigation. Since there are no review comments, I have no feedback to provide.

[github-actions]

🚀 Preview Deployment

Your preview deployment is ready!

🔗 Preview URL: https://preview.harper-documentation.harperfabric.com/pr-603

This preview will update automatically when you push new commits.

[Ethan-Arrowood]

LGTM — I verified every security-relevant claim against the WAF source at harper-pro#517's head: fail-open posture, before-auth placement, X-Forwarded-For distrust / PROXY-protocol IP recovery, RE2 linear-time matching, shadow/monitor/off modes, activation gating, super_user gating on system.hdb_waf_rules, the rule schema, and all numeric defaults. All accurate.

One heads-up: harper-pro#517's PR description still calls RE2 a follow-up ("prototype uses JS RegExp"), but the head code imports re2, so the doc's ReDoS-safety claim is backed. Just keep the two in sync when #517 lands.

_{sent with Claude Opus 4.8}