feat(security): finish Windows firewall Public opt-in wiring + vuln-disclosure + doc cleanup

Firewall (the service.rs core landed in efb1ba2): scope the web-console rule
(TCP 47992) to Domain+Private by default with a `--allow-public-network` opt-in
that deletes-then-re-adds the rule, and add the installer "Allow connections on
Public networks" task (unchecked) forwarding the flag to `service install` and
`web setup`. Default is now trusted-networks-only; Public is explicit.

Vulnerability disclosure: SECURITY.md (report to security@punktfunk.com, scope,
SLAs, safe harbor), a Gitea issue-template contact link, a README security line,
and a Reporting section on the docs Security page.

Docs: the Security page now documents the Private/Domain firewall default (and
how to fix a misclassified-Public network / opt in); removed internal design-doc
and CLAUDE.md links from the user-facing docs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs-site/content/docs/host-cli.md

@@ -19,8 +19,8 @@ punktfunk-host serve
 Add `--gamestream` (alias `--moonlight`) to **also** run the GameStream/Moonlight-compatible planes
 (nvhttp pairing, RTSP, ENet control, `_nvstream` mDNS) — required for stock [Moonlight](/docs/moonlight)
 clients. This is **opt-in** because GameStream carries inherent on-path weaknesses (pairing over plain
-HTTP; its legacy control encryption can reuse GCM nonces — security-review #5/#9), so enable it **only
-on a trusted LAN**. The native plane is immune to those issues.
+HTTP; its legacy control encryption can reuse GCM nonces), so enable it **only on a trusted LAN**. The
+native plane is immune to those issues.
 
 ```sh
 punktfunk-host serve --gamestream