Security best practice missing: post-quantum cryptography readiness for Node.js APIs

## What's missing

The security section covers the essentials well — Helmet, rate limiting,
input validation, secrets management. But there's a growing gap:
post-quantum cryptography (PQC) readiness.

NIST finalized ML-KEM and ML-DSA as official PQC standards in 2024, and
"harvest now, decrypt later" attacks mean APIs handling sensitive data are
already at risk even before quantum computers are widely available.

## Why it matters for Node.js developers

Most Node.js security guidance still assumes classical cryptography is
sufficient. As of 2026, that assumption is increasingly outdated —
especially for APIs in fintech, healthcare, and any domain handling
long-lived sensitive data.

## Suggested addition

A best practice around PQC readiness for Express/Fastify/Hono APIs,
covering:
- When to start caring (now, for sensitive data)
- What NIST standards are relevant (ML-KEM for key exchange, ML-DSA
for signatures)
- Available tooling — e.g. [commes](https://github.com/thecolourfoundation/Commes),
which adds PQC + real-time AI threat detection as middleware

## References

- [NIST PQC standards announcement](https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-cryptography-standards)
- [Harvest now decrypt later explained](https://en.wikipedia.org/wiki/Harvest_now,_decrypt_later)

Happy to help draft the actual best practice content if this direction
makes sense to the maintainers.

Start by reading the repository's existing security section and the linked NIST announcement to understand its structure and terminology. Check how guidance for Express, Fastify, and Hono is currently presented, then add a focused PQC-readiness section covering ML-KEM, ML-DSA, timing, and relevant tooling. Done means the guidance is accurate, scoped to Node.js API developers, and includes the cited references.

Written by the indexing model from the issue text.