Security hardening: headers, scanning, Docker, firewall

- Caddy: HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy,
  Permissions-Policy on all responses
- Caddy: Block scanner paths (.env, .git, wp-config, etc.) with 403
- CI: Gitleaks secret scanning + pnpm audit for vulnerabilities
- Dependabot: Weekly npm + GitHub Actions + monthly Docker updates
- Docker: Non-root user in journal, planner, and brouter containers
- Server: UFW firewall (22/80/443 only) + fail2ban (8 IPs already banned)
- SECURITY.md: Vulnerability disclosure policy
- Privacy page: Security practices section added

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

SECURITY.md

@@ -0,0 +1,44 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in trails.cool, please report it
+responsibly.
+
+**Do NOT open a public GitHub issue for security vulnerabilities.**
+
+Instead, please email: **security@trails.cool**
+
+Include:
+- Description of the vulnerability
+- Steps to reproduce
+- Impact assessment (what could an attacker do?)
+- Any suggested fixes
+
+We will acknowledge your report within 48 hours and provide a timeline for
+a fix. We aim to resolve critical vulnerabilities within 7 days.
+
+## Scope
+
+The following are in scope:
+- trails.cool and planner.trails.cool (production)
+- The trails-cool/trails GitHub repository
+- Authentication, authorization, and session management
+- Data exposure or leakage
+- Server-side vulnerabilities
+
+The following are out of scope:
+- Denial of service attacks
+- Social engineering
+- Self-hosted instances (report to the instance operator)
+- Issues in third-party dependencies (report upstream)
+
+## Security Practices
+
+- **Authentication**: Passkey (WebAuthn) + magic link login. No passwords stored.
+- **Cookies**: httpOnly, secure, sameSite=lax
+- **Database**: Parameterized queries via Drizzle ORM (no raw SQL)
+- **Headers**: HSTS, CSP, X-Frame-Options, X-Content-Type-Options
+- **CI**: Gitleaks secret scanning, dependency auditing
+- **Docker**: Non-root containers
+- **Monitoring**: Sentry error tracking, fail2ban SSH protection