docs: seed PRD for security headers + rate-limit + SBOM (ADR-025 Epic C)

Implementation seed for ADR-025 Epic C: six security headers middleware
with nonce-based CSP in core-shared/security (Next + TanStack adapters),
fourth conformance channel for rate-limit in core-shared/rate-limit
(IRateLimit + RateLimited brand + multi-budget manifest field +
no-undeclared-rate-limit ESLint rule), CycloneDX SBOM step in
release-please.yml. auth.signIn backfilled as canonical rate-limit
reference. ADR-023 amendment for SBOM captured. Status: approved —
ready for pnpm work decompose.

docs/work/_system/_state.json

@@ -1,5 +1,5 @@
 {
-  "updated_at": "2026-05-19T11:06:54.525Z",
+  "updated_at": "2026-05-19T11:09:21.707Z",
   "epics": {
     "binder-wrap-helper": {
       "status": "done",