docs(security): document the authentication and access-control model

[alucero270]

docs(security): document the authentication and access-control model

Summary

Document how authentication and source-scoped authorization work so operators and developers understand the security model clearly.

Scope

• Files: security docs, README.md, docs/operations.md, architecture docs as needed
• Components: authentication model, authorization model, operational guidance

Acceptance Criteria

• the docs explain the authentication model and source-scoped authorization model clearly
• the docs explain the expected operational setup and verification flow
• the docs are understandable without internal context

Notes

• This is documentation-only and should reflect implemented access-control behavior