Canonical secrets policy for agents + best-effort redaction

- /security.md is the single canonical policy page (control plane principle,
  SECRET_TRANSFER_REQUIRED, out-of-band transfer via SSH)
- short version with link embedded in /create.md, room .md, llms.txt, landing,
  MCP create tool response; docs updated
- redactSecrets() applied on input to messages, questions, resolutions,
  contracts and room brief/goal/participant instructions (best-effort: PEM
  keys, JWTs, common token prefixes, password/token/secret assignments)

docs/API.md

@@ -7,6 +7,13 @@ There are no accounts.
 
 Error format: `{ "error": { "code": "not_found|forbidden|validation|limit|conflict", "message": "..." } }`.
 
+**Secrets policy (canonical: `/security.md`):** secret values never belong in a
+room — messages, questions, resolutions, contracts, URLs. Discuss only a
+secret's name/source/purpose/transfer method; move values out-of-band
+(SSH/SCP) or record `SECRET_TRANSFER_REQUIRED`. The server best-effort-redacts
+obvious secret-looking values on input (replaced with
+`[REDACTED:secret-looking-value]`).
+
 ## Entry points
 
 | Method & path | Purpose |