chore(repo): initial baseline import (docs v0.9.2 + bootstrap)

Imports the v0.9.2 documentation baseline and the bootstrap files
required by docs/governance/repository-bootstrap-plan.md v0.1.0 §3,
minus the justfile (added in the next commit).

This commit establishes the git history for the project. All previous
work lived only as filesystem state with no version control.

SECURITY.md

@@ -0,0 +1,51 @@
+# Security Policy
+
+## Supported status
+
+Chanora is not production-ready yet. Security reports are still welcome during early development.
+
+## Reporting a vulnerability
+
+Do not open public issues for sensitive security reports.
+
+Until a private security channel is established, report security concerns directly to the project maintainer through the agreed private contact channel.
+
+## Sensitive areas
+
+Important security areas include:
+
+- identity private keys and identity material;
+- server passwords;
+- platform secure storage;
+- local database contents;
+- diagnostic logs and export bundles;
+- protocol input from compatible servers;
+- Flutter/Rust bridge DTO validation;
+- audio permission behavior;
+- dependency and supply-chain integrity;
+- OSS license and attribution compliance.
+
+## Security gates before public release
+
+Before any public or store release, the following documents must be completed and reviewed:
+
+```text
+docs/security/threat-model.md
+docs/security/secure-storage-audit-report.md
+docs/security/diagnostic-redaction-audit-report.md
+docs/security/dependency-and-supply-chain-report.md
+docs/privacy/privacy-policy.md
+docs/legal/trademark-and-attribution-review.md
+```
+
+## Secret handling rule
+
+Secrets must not be stored in plaintext local storage or written to logs.
+
+Secrets include:
+
+- server passwords;
+- identity private keys;
+- authentication tokens if later added;
+- secure-storage keys;
+- signing credentials.