docs: fix the stale endpoint list and module name in the search token lifecycle

### Problem

The Search Token Lifecycle section of `docs/security.md` is behind the code in two places:

- Step 3 says the token travels on "all `/search/text`, `/search/images` and `/page-content` requests". `/thumbnail` and `/inference` are token-gated too (`server/thumbnailEndpointServerHook.ts`, `server/internalApiEndpointServerHook.ts`).
- Step 4 places `handleTokenVerification()` "in `searchEndpointServerHook.ts`". It has had its own module for a while now (`server/handleTokenVerification.ts`), and the hooks import it from there.

This matters more than it used to, because `docs/api.md` (#2570) sends readers to that exact section for the token lifecycle instead of restating it.

### Solution

Fix the endpoint list and the module name in those two steps.

### Acceptance criteria

- Step 3 names all five token-gated endpoints.
- Step 4 points at `server/handleTokenVerification.ts`.
- `npm run lint` still passes.

### Implementation notes

Size: **S**. `docs/security.md`, the Search Token Lifecycle section, steps 3 and 4.

Found while reviewing #2570.

Open the Search Token Lifecycle section in docs/security.md and compare steps 3 and 4 with server/thumbnailEndpointServerHook.ts, server/internalApiEndpointServerHook.ts, and server/handleTokenVerification.ts. Update step 3 to name all five token-gated endpoints and step 4 to reference server/handleTokenVerification.ts. Run npm run lint; done means both stale references are corrected and lint passes.

Written by the indexing model from the issue text.