docs(security): add 2026-04 tracker demo security review

[josecelano-bot]

Summary

This PR adds the recurring security review plan and the first completed 2026-04 review cycle for the tracker demo.

It includes:

• the reusable security review process and review-folder structure
• the seeded 2026-04 review workspace and summary docs
• documented public-surface and static-config review results
• clarified linting guidance and supporting dictionary updates
• issue and review documentation needed to continue future cycles cleanly

Confirmed Findings

The 2026-04 review currently records these low-severity findings:

• Public Grafana host discloses operational metadata before auth
• Public HTTPS hosts do not advertise HSTS
• Mutable container tags reduce deployment traceability
• Public tracker API host returns 500 with internal auth error text

Validation

• ./scripts/lint.sh

Notes

The static-config and public-surface review is complete in-repo. Remaining unresolved items are explicitly documented as host-runtime evidence blockers.

Refs: #13

[josecelano]

ACK ef593c5