docs: plan, agent operating rules, and an honest security model

PLAN.md locks the architectural decisions (WebRTC mesh with the sharer as
sole offerer, JSON-only signaling, in-memory roster with no database, no
auth, no CDN, Linux as the reference platform) and records the roster rules,
the verification ladder, and the constraints that are accepted rather than
hidden: the secure-context requirement, mesh upload scaling with watcher
count, and the Wayland portal's per-share prompt.

Phases are deliberately not written yet -- the prototype and its tests came
first, so .agents/phases/todo/ holds only a README pointing at the candidate
phase list in PLAN.md section 7.

SECURITY.md answers the question a no-auth tool has to answer: not "who is
allowed in" but "where is this allowed to run". It separates what an
unauthenticated LAN visitor can do from the guarantees that are enforced and
named to a test, and tells users the two things they will actually hit --
that http://<lan-ip> hides getDisplayMedia, and that on Wayland the
compositor asks every time and mirror must not work around it.

LLM-Generated: true

.agents/phases/todo/README.md

@@ -0,0 +1,14 @@
+# Pending phases
+
+Intentionally empty at the prototype stage. The prototype was built and verified
+first; the candidate phase list is §7 of `.agents/PLAN.md`.
+
+Add phases here with the **`phase-authoring` skill** — one directory per phase:
+
+```
+NN_phase_name/
+├── 00_phase.md      # intent, scope, out-of-scope, acceptance, verification
+└── NN_task.md       # independently runnable tasks
+```
+
+Every phase must leave the four gates in `AGENTS.md` §4 green on its own.