Canonical secrets policy for agents + best-effort redaction

- /security.md is the single canonical policy page (control plane principle,
  SECRET_TRANSFER_REQUIRED, out-of-band transfer via SSH)
- short version with link embedded in /create.md, room .md, llms.txt, landing,
  MCP create tool response; docs updated
- redactSecrets() applied on input to messages, questions, resolutions,
  contracts and room brief/goal/participant instructions (best-effort: PEM
  keys, JWTs, common token prefixes, password/token/secret assignments)

packages/server/test/integration.test.ts

@@ -151,6 +151,14 @@ test('HTTP: cannot read room by id without token; unknown routes 404; human page
     assert.match(llms, /^# http/ms);
     assert.match(llms, /\/api\/rooms/);
     assert.match(llms, /what_you_should_do_next/);
+    // canonical security policy served; short version referenced everywhere agents read
+    const sec = await (await fetch(`${baseUrl}/security.md`)).text();
+    assert.match(sec, /control plane/);
+    assert.match(sec, /SECRET_TRANSFER_REQUIRED/);
+    assert.match(llms, /security\.md/);
+    const createMd = await (await fetch(`${baseUrl}/create.md`)).text();
+    assert.match(createMd, /security\.md/);
+    assert.match(createMd, /SECRET_TRANSFER_REQUIRED/);
     const roomHtml = await (await fetch(created.invite_urls[0])).text();
     assert.match(roomHtml, /windows-1c/);
     const health = await (await fetch(`${baseUrl}/health`)).json();