Add the Transports and Security page Written from the application developer's side: the four endpoint forms and where the endpoint comes from, what trust-on-first-use does on a first connect and on a changed fingerprint, the client identity generated on first use, and the two files and five environment variables a client touches. Host configuration is deliberately absent -- lockdown, the authorization store, prompt policy and the serve-side Config are the host environment's business and belong with that section once it is further developed. Every claim checked against the code rather than taken from the design doc: the endpoint forms and port from client/endpoint.go, the fingerprint messages verbatim from verifyPin, the config directory rule from ConfigDir, and the Python and C transport support from their interop tests.