docs: link SECURITY.md from README and docs landing page #154

Problem

SECURITY.md exists at the repo root but is not linked from README.md. First-time visitors evaluating WaveHouse for a production-ish use case will look for it; the README has CI / Go version / License badges and a feature pitch, but no pointer to security disclosure or posture.

Proposed Solution

• Add a ## Security section near the bottom of README.md linking to SECURITY.md with a one-line summary of the disclosure channel.
• Cross-link from docs/src/content/docs/index.mdx so the public docs site has the same surface.
• Optional but cheap: add a Security badge to the README header (e.g. linking to the security issue label or to SECURITY.md directly).

Acceptance criteria

• SECURITY.md reachable in one click from both README.md and wavehouse.dev.