chore(trust): /security page with SLA, uptime commitment and subprocessor list

## Problem
No SOC 2, no ISO 27001, no pen-test report, no vulnerability-disclosure policy anywhere on the public surface. **`/security` does not exist** — it soft-404s into the dashboard SPA with HTTP 200 (`vercel.json` catch-all rewrite to `/dashboard.html`).

## Coordination
#6575 is the unknown-path 404 fix. **Do not let that issue 404 `/security` as the product outcome.** This issue *is* the page. Sequence: either land this page first (then #6575 404s everything else), or have #6575 404 unknown paths while allow-listing `/security` for this PR.

## What we actually have and should be showing
More than most vendors ten times our size, but it is invisible:
- **11 named subprocessors** already disclosed: Clerk, WorkOS, Convex, Dodo Payments, Sentry, Vercel, Cloudflare, Axiom, Anthropic, OpenRouter, Resend
- Webhook security: HMAC-SHA256 `X-WM-Signature`, secrets AES-256-GCM at rest, HTTPS-only with an SSRF guard rejecting private/loopback resolution
- Fail-closed alert delivery
- A published incident and correction posture in docs

## Build
A `/security` page consolidating: subprocessors, data handling and retention, encryption in transit and at rest, the webhook security model, the SSRF posture, a vulnerability-disclosure/contact address, SLA and uptime commitment, and an honest compliance-roadmap statement (see the SOC 2 issue).

Add `/security` to the `vercel.json` rewrite allow-list (the negative lookahead on the dashboard catch-all) so it does not keep serving `dashboard.html`.

## Acceptance
- [ ] `/security` live with all of the above
- [ ] Not rewritten to `dashboard.html`
- [ ] SLA published
- [ ] Vulnerability-disclosure contact
- [ ] Linked from footer, docs and pricing
- [ ] Status page fixed (separate issue) and linked
- [ ] Coordinated with #6575 so unknown paths 404 without killing this page

Effort: M (~2d).

Start with vercel.json and inspect the dashboard catch-all rewrite and its negative lookahead. Then find the existing footer, docs, and pricing entry points for links. Done means /security serves the new page instead of dashboard.html, includes the listed security, SLA, contact, and compliance information, and is coordinated with #6575.

Written by the indexing model from the issue text.