Express/Node security middleware moved out of @trebired/frontend/
server, which had accumulated it despite having nothing to do with
frontend rendering. Adds attachSecurity(app), a single entry point
that reads .trebired/security/config.ts for system order and options,
replacing the per-file attachCore* wiring pattern. Request logging's
quietSuccessRoutes option is gone; every request logs.