Documentation precision release. SECURITY.md now names the complete set of routes open on loopback (the profile version list, the disposable-identity probe, and profile regeneration were missing); TUNING.md documents that trusted hosts can be set by config key as well as environment variable, and their different shapes; the credential gate is stated once, in one place. The HTTP contract_version stays 1.1, unchanged.