docs/SECURITY.md doesn't mention the HSTS_INCLUDE_SUBDOMAINS opt-in or its sibling-domain risk

## What

docs/SECURITY.md lists HSTS among the headers every response carries, but never mentions the `HSTS_INCLUDE_SUBDOMAINS` opt-in or the risk of turning it on.

## Where

docs/SECURITY.md:34 lists HSTS in the security headers row.

.env.example:544 to 547:

```
# HSTS is opt-in only for includeSubDomains: on studio.example.com it would also
# upgrade every unrelated sibling host to HTTPS-only.
# HSTS_INCLUDE_SUBDOMAINS=false
```

## Expected

docs/SECURITY.md names the var and the sibling domain risk of enabling it.

## How to fix

Add a short note near docs/SECURITY.md's HSTS row, or in the nearby prose, summarizing the .env.example comment above.

## How to check

docs/SECURITY.md names `HSTS_INCLUDE_SUBDOMAINS` and explains what happens if it is turned on.

Open docs/SECURITY.md around line 34 and compare the related comment in .env.example lines 544-547. Update the nearby HSTS documentation to name HSTS_INCLUDE_SUBDOMAINS and explain the sibling-domain risk when enabled; done when both are clearly stated.

Written by the indexing model from the issue text.