Document the security model of the secrets path

[czpython]

What changes

docs/security.md gets the secrets path under three headings, in short sentences with one fact each:

• Which field to use: env for configuration, secrets for a credential, with the encryption and the key rotation.
• What the proxy protects: the placeholder's scope, the one header swapped, the refused destinations, where the real value lives, what deletion removes, and what the CA in the box means.
• What env is and is not: plaintext by design, with the PAM rules. No secrets in env, ever.

The provider material paragraphs, the Tailscale auth key and IMDS, keep their facts under a heading of their own. Every other section of the document is unchanged.

Where this differs from the ticket

• The ticket lists five sections, "What none of this fixes" among them. The document has three. The host-side caveats are out. The CA and the teardown facts sit under "What the proxy protects".
• The ticket says the CA key lives on the exchange host next to SECRETS_KEY. The key lives in the proxy's volume. The document says the volume, and says to guard it like SECRETS_KEY.
• The ticket names the field hosts.env. The field is env on POST /hosts, and the document names it that way.
• Proxy internals that architecture.md and deploy.md already carry, the 403 answer, flow_detail, and the SSH remote rewrite, are not repeated here.

Names

None new.

Gates

uv run ruff check, uv run ruff format --check, uv run pyright, and uv run pytest are green.

Acceptance

A documentation change. The facts were checked against the code and the deploy doc while writing.

Review

The adversarial review reported six overstatements in the prose, applied in an earlier revision. Three of them are still in the text after the cut:

• The CA key permits impersonation of any host to the box, since the CA sits in the system trust store.
• A placeholder works until the host row is deleted. The lease schedules that deletion and revokes nothing on its own.
• The swap applies to HTTPS the proxy terminates. Plain HTTP is forwarded unchanged.

The review also noted that the exchange answers for a host past its lease until the row is deleted. That is how the code works today. A check of expires_at in the exchange would be a product change for its own ticket.