docs: the "No External Requests" privacy bullet is inaccurate for browser-only mode

### Problem

`docs/security.md` lists under Privacy:

> - **No External Requests**: Optional browser-only mode for complete privacy

Browser-only mode downloads its models from HuggingFace in the browser: `client/modules/wllama.ts` calls `wllama.loadModelFromHF(...)` at lines 49 and 77, so `huggingface.co` and its CDN see the user's IP. The bullet predates this, it is not caused by any recent change, but it is the first thing a privacy-minded reader checks.

It now sits a few lines above the text-to-speech bullet added in #2590, which spells out exactly which third-party hosts are contacted. Having both in the same list reads as a contradiction.

### Solution

Reword the bullet to say what is actually true: no telemetry and no search traffic leaving the instance, with model downloads named as the exception, the same way the text-to-speech bullet names its hosts.

### Acceptance criteria

- The bullet no longer claims there are no external requests.
- It names model downloads from HuggingFace as the exception, for both wllama and the local text-to-speech voices.
- `npm run lint` still passes.

### Implementation notes

Size: **S**. `docs/security.md`, the Privacy section.

Found while reviewing #2590.

Start in the Privacy section of docs/security.md and compare the inaccurate bullet with the text-to-speech bullet added in #2590. Check client/modules/wllama.ts at the referenced loadModelFromHF calls to confirm the model-download exception, then run npm run lint. Done means the bullet no longer claims no external requests and names HuggingFace model downloads for wllama and local text-to-speech voices.

Written by the indexing model from the issue text.