chore: add security pentest reports and remediation plan

Overnight pentest run produced recon, analysis, exploitation reports,
and a full security assessment. Plan.md updated with 22 prioritized
fix items for auth, SSRF, injection, XSS, and hardening.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

loop/pentest/report.md

@@ -0,0 +1,12 @@
+Report written to `loop/pentest/security-assessment-report.md`.
+
+**Summary of what's in the report:**
+
+- **21 confirmed findings** across 4 severity levels (6 Critical, 7 High, 5 Medium, 3 Low)
+- Full exploitation evidence with request/response pairs for every finding
+- Root cause analysis showing AUTH-001 (no session management) as the single point of failure — fixing it blocks 15 of 21 findings
+- A documented attack chain demonstrating full node takeover in 6 curl commands
+- Prioritized remediation table (P0 within 48 hours through P2 within 1 month)
+- Appendix with excluded findings, technology inventory, and dependency tree of vulnerabilities
+
+The most critical takeaway: the existing session middleware in `core/startos/src/middleware/auth.rs` just needs to be wired into `core/archipelago/`'s HTTP handler. That single integration addresses the root cause of nearly every finding.