feat(security): finish Windows firewall Public opt-in wiring + vuln-disclosure + doc cleanup

Firewall (the service.rs core landed in efb1ba2): scope the web-console rule
(TCP 47992) to Domain+Private by default with a `--allow-public-network` opt-in
that deletes-then-re-adds the rule, and add the installer "Allow connections on
Public networks" task (unchecked) forwarding the flag to `service install` and
`web setup`. Default is now trusted-networks-only; Public is explicit.

Vulnerability disclosure: SECURITY.md (report to security@punktfunk.com, scope,
SLAs, safe harbor), a Gitea issue-template contact link, a README security line,
and a Reporting section on the docs Security page.

Docs: the Security page now documents the Private/Domain firewall default (and
how to fix a misclassified-Public network / opt in); removed internal design-doc
and CLAUDE.md links from the user-facing docs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

crates/punktfunk-host/src/windows/install.rs

@@ -392,6 +392,21 @@ fn web_setup(args: &[String]) -> Result<()> {
     register_web_task(&cmd)?;
     // 4. firewall: inbound TCP 47992. The console serves HTTPS (HTTP/1.1 over TLS) with the host's
     //    identity cert. (No UDP/HTTP-3: browsers won't use QUIC against a self-signed/no-SAN cert.)
+    //    Scoped to the same profiles as the streaming ports — Domain + Private by default, Public
+    //    only with `--allow-public-network`. Delete any prior rule first so an upgrade re-scopes it
+    //    instead of stacking a second (possibly all-profiles) rule behind the new one.
+    let fw_profile =
+        crate::service::firewall_profile_arg(crate::service::allow_public_network(args));
+    run_quiet(
+        "netsh",
+        &[
+            "advfirewall",
+            "firewall",
+            "delete",
+            "rule",
+            "name=punktfunk web console (TCP 47992)",
+        ],
+    );
     if !run_quiet(
         "netsh",
         &[
@@ -404,6 +419,7 @@ fn web_setup(args: &[String]) -> Result<()> {
             "action=allow",
             "protocol=TCP",
             "localport=47992",
+            fw_profile,
         ],
     ) {
         eprintln!("warning: could not add the firewall rule for TCP 47992");