[WM-IMP-2] No threat model documented for the system

## WM-IMP-2 — No Threat Model

**Category:** Improvement | **Priority:** High

### Observation
No threat model exists for the system. SP 800-154 and secure-by-design principles require a documented threat model identifying attack surfaces, threat actors, and mitigations.

### Evidence
- Issue #636 — no threat model noted as critical finding (C4)

### Recommendation
Produce a STRIDE-based or PASTA threat model covering MCP endpoints, tenant data flows, AI model interactions, and auth surfaces.

### Acceptance Criteria
- [ ] Threat model document created and stored in repo
- [ ] Key attack surfaces identified: API endpoints, auth flows, AI model inputs, file handling, tenant isolation
- [ ] Mitigations mapped to each threat
- [ ] Threat model reviewed and updated with each major architectural change