Threat model for alunduil personal infrastructure follows OWASP and STRIDE methodology

## Summary

Produce a documented threat model that follows established industry methodology — OWASP Threat Modeling Manifesto, OWASP Top 10 2021, Microsoft STRIDE, CIS Google Cloud Foundations Benchmark, CIS GitHub Benchmark — and keep it as a living document tracking applicable categories, current posture, gaps, and mitigations. Each unmitigated finding becomes a tracked issue.

## Motivation

Ad-hoc threat conversations are happening (#77, the PR #79 review thread, #80–#83). The bucket-share path was found because alunduil noticed it during review, not because anything systematically walked the surface. A repeatable methodology (OWASP Top 10 categories + STRIDE per data flow) catches what intuition misses and turns "what about X?" into "where does X land in the matrix?"

The value is the **systematic coverage**, not "we said the word OWASP." Methodology is the lever.

## Scope

This issue is the threat-model **methodology** — STRIDE, OWASP, CIS, mitigations. The data-flow diagram it analyzes is its own artifact (#143); this issue consumes that diagram rather than producing it.

- **Methodology citations.** Cite explicitly so the framing is reviewable:
- OWASP Threat Modeling Manifesto — the four questions ("what are we building / what could go wrong / what are we going to do / did we do a good enough job").
- OWASP Top 10 2021 — assessment per category.
- Microsoft STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) — per data-flow analysis.
- CIS Google Cloud Foundations Benchmark — applicability call against the GCP project.
- CIS GitHub Benchmark — applicability call against the GitHub identity + Actions surface.
- NIST SP 800-30 — risk-rating shape (likelihood × impact).
- **System overview.** Reference the data-flow diagram (#143) and the asset inventory (#141) rather than re-enumerating. The DFD owns the flows and the GCP/Cloudflare internals (WIF, deployer SAs, Secret Manager, zone, records, tokens) as DFD elements with trust boundaries; this threat model layers STRIDE/OWASP/CIS on top of it.
- **STRIDE per data flow.** Apply STRIDE to each significant flow enumerated in the DFD (#143):
- Operator workstation → bootstrap apply → GCP/Cloudflare
- Plan workflow → state bucket → GCP
- Apply workflow → Secret Manager → Cloudflare API
- GitHub App → repo administration
- MCP fleet → external SaaS (Notion, Readwise, GitHub, Cloudflare, TrueNAS, UptimeRobot)
- chezmoi apply → workstation
- **OWASP Top 10 (2021) assessment.** One section per category, **explicit applicable / not-applicable verdict with rationale** — including the app-layer categories (A03 Injection, A07 Authn Failures, A10 SSRF). "Not applicable because..." is a section, not a skip.
- **Mitigations matrix.** Per finding: current posture (none / partial / mitigated / accepted-risk), planned change (link to tracked issue), residual risk.
- **Living document.** Capture a review cadence (quarterly? on every architectural change? on every new external integration?) and a "how to update" section so future-me/Claude knows what triggers a refresh.
- **Location.** `docs/security/threat-model.md`. Promote to `docs/security/threat-models/` only if scope splits (e.g. per-environment).
- **File gap issues** uncovered during the initial pass and link them from the document.

## Acceptance criteria

- [ ] `docs/security/threat-model.md` exists with sections for: methodology citations, system overview (refs DFD #143), STRIDE per flow, OWASP Top 10 2021 assessment per category, mitigations matrix, review cadence, update procedure
- [ ] Every OWASP Top 10 category has an explicit applicable / not-applicable verdict (no skips)
- [ ] Every STRIDE category has explicit coverage per data flow in the DFD (#143)
- [ ] CIS Google Cloud Foundations Benchmark applicability call rendered
- [ ] CIS GitHub Benchmark applicability call rendered
- [ ] Findings without an existing fix have a tracked follow-up issue linked
- [ ] Diátaxis classification: explanation

## Additional context

Blocked by the DFD (#143) — STRIDE per data flow only works once the flows are enumerated, and that's #143's job. The OWASP/CIS assessments depend on knowing the system inventory, which the DFD and the asset inventory (#141) carry; the C4 model (#84) closed as not planned, so nothing here waits on it. Origin: PR #79 review and the threat-model conversation that produced #77, #80, #81, #82, #83. Those follow-ups become entries in the mitigations matrix when this document lands.