chore: initial foundation — server skeleton, autodocs, CI

- minimal Axum server exposing GET /health
- OpenAPI contract generated from handlers (gen_openapi -> openapi.json),
  drift-gated in CI so the spec can never silently diverge from the code
- CI: secret-scan + gitleaks, openapi drift gate, fmt/clippy/build/test/doc-test, cargo-deny
- Cargo.lock tracked for reproducible builds; publish=false; pinned toolchain
- README, SECURITY.md, deny.toml, .env.example

SECURITY.md

@@ -0,0 +1,28 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please report security issues **privately**. Do not open public issues or pull
+requests for vulnerabilities.
+
+- Email: security@smirk.cash
+- Encrypt sensitive reports with our PGP key (fingerprint published at
+  `https://smirk.cash/.well-known/security.txt`).
+
+Include enough detail to reproduce: affected endpoint/component, version or
+commit, and a proof of concept where possible. We aim to acknowledge reports
+within 72 hours and to keep you updated as we triage and fix.
+
+## Scope
+
+This repository (`smirk-backend-core`) — the self-hostable backend. Issues in
+node software it talks to (Bitcoin/Litecoin/Monero/Wownero/Grin daemons,
+light-wallet servers, Electrum) should be reported to those projects, though
+we welcome reports about how this backend uses them.
+
+## Operating securely
+
+`smirk-backend-core` is non-custodial: it never stores seeds or spend keys.
+The admin surface authenticates with seed-derived public keys ("Sign in with
+Smirk") and stores only public keys. Default deployment posture binds admin and
+setup to loopback / a Tor hidden service. See `docs/` for the hardening guide.