organize deployment configs and documentation

docs/security.md

@@ -0,0 +1,22 @@
+# Security model
+
+- SQL statements use bound parameters.
+- Short codes are restricted to ASCII alphanumerics.
+- URL, retention, code, and request-body sizes are bounded.
+- API-key comparison is constant-time. Protected operations return no body on
+  authentication failure.
+- Per-IP sliding-window throttling applies to API calls and redirects. Embedded
+  frontend files do not consume API quota.
+- Client identity uses `X-Real-IP`, then the first `X-Forwarded-For` value,
+  then the TCP peer. Bind the container port to loopback and let only a trusted
+  reverse proxy overwrite those headers.
+- CORS preflight uses `OPTIONS` and does not consume rate-limit quota.
+- The runtime Compose definitions use a read-only root filesystem, drop Linux
+  capabilities, enable `no-new-privileges`, and run as a numeric non-root user.
+- The runtime image contains no shell, package manager, Python runtime, or
+  external static files.
+- `SIGINT` and `SIGTERM` cleanly unblock the server for prompt shutdown.
+
+Keep `api_key` out of Git, image layers, command output, and monitoring labels.
+The supplied nginx configurations forward trusted proxy headers and keep the
+application port bound to `127.0.0.1`.