chore(work): finish epic security-headers-rate-limit-sbom

docs/work/epics/security-headers-rate-limit-sbom/_epic.md

@@ -3,11 +3,11 @@ id: security-headers-rate-limit-sbom
 prd: docs/work/prds/security-headers-rate-limit-sbom.prd.md
 title: Security headers + rate-limit primitive + SBOM in CI — Epic C of ADR-025
 type: epic
-status: in-progress
+status: done
 features:
   [core-shared, core-testing, core-eslint, auth, web-next, web-tanstack, cms]
 created: 2026-05-20T00:00:00Z
-updated: 2026-05-20T11:33:07.860Z
+updated: 2026-05-20T11:49:44.873Z
 ---
 
 ## Goal
@@ -30,4 +30,4 @@ Security scanners flag the absence of HSTS, X-Frame-Options, X-Content-Type-Opti
 - [x] [08 — App wiring: web-next](08-app-wiring-web-next/_story.md)
 - [x] [09 — App wiring: web-tanstack and cms](09-app-wiring-web-tanstack-and-cms/_story.md)
 - [x] [10 — SBOM CI workflow and ADR-023 amendment](10-sbom-ci-workflow/_story.md)
-- [ ] [11 — Documentation and conformance reference updates](11-documentation/_story.md)
+- [x] [11 — Documentation and conformance reference updates](11-documentation/_story.md)