Consolidated security hardening checklist

[karutoil]

Summary

Security hardening guidance is currently scattered across multiple docs (docker-setup.md, INSTALLATION_DETAILED.md, troubleshooting.md, SECURITY.md). Consolidate into a single actionable hardening checklist for production deployments.

Current State

• docs/SECURITY.md covers vulnerability disclosure policy only
• docs/docker-setup.md has a "Hardening" section (security headers, TLS, secrets)
• docs/INSTALLATION_DETAILED.md has TLS configuration and .env security notes
• docs/troubleshooting.md references rate limiting, CORS, and firewall issues
• prompt/SECURITY_REVIEW_PROMPT.md and prompt/SECURITY_QUICK_REFERENCE.md are AI audit tools, not deployer guides
• No single document walks through all hardening steps in order

Requirements

Hardening Checklist Categories

1. Network: TLS termination, firewall rules, CORS strict mode, HSTS, CSP headers
2. Authentication: 2FA enforcement, passkeys, brute-force lockout config, session expiry, OIDC hardening
3. Authorization: RBAC least-privilege, API key scoping, admin separation
4. Data: Database connection encryption, backup encryption (AES-256-GCM), SFTP isolation, secret rotation
5. Agent: containerd socket permissions, firewall rule persistence, binary verification (checksums), auto-update signing
6. Infrastructure: Docker/Podman security, volume isolation, resource limits, log aggregation, monitoring
7. Plugins: permission auditing, runtime isolation, storage scoping

Format

• Numbered checklist with severity (required/recommended/optional)
• Each item: what to do, why it matters, how to verify it's done
• Quick-start: top 10 items for a minimally secure deployment
• Broken links fix: docs/README.md and docs/troubleshooting.md reference SECURITY_QUICK_REFERENCE.md and SECURITY_REVIEW_PROMPT.md as if they're in docs/ — they're actually in prompt/

Acceptance Criteria

• Single docs/security-hardening.md document
• Covers all 7 categories above with actionable steps
• Quick-start section with top 10 critical items
• Each item has: action, rationale, verification command
• Broken doc links to prompt/ files are fixed
• Referenced from docs/README.md and INSTALLATION_DETAILED.md