docs(azure): add SECURITY-MODEL.md - envelope encryption explained without jargon

Glossary + 6 sections: 2-key envelope (KEK/DEK/AAD), ephemeral DEK for Hybrid Agent batches, BIP39 break-glass, audit log mirror on Log Analytics, summary table, anti-goals.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: robgrame