V1 [D4] Security documentation

[austin-barrington]

Context

Auth (if any), TLS modes, and operator secrets (S3 backup credentials) must match actual behavior for audits.

Deliverables

• User-guide section: auth configuration, TLS with cert-manager vs operator-generated certs, secrets handling and rotation hints.
• Link to threat model lite (ticket S1) when available.

References

docs/user-guide/authentication.md; docs/user-guide/operator/cluster.md; docs/user-guide/operator/backup-restore.md