docs: Add threat model and clarify security mitigations

[bokelley]

Summary

Addresses #177 by adding explicit threat model documentation and clarifying which mitigations address which threats.

Key Changes

1. Added Threat Model section - Explicit threat categories with primary mitigations
2. Added Domain Trust Assumption section - Clearly explains why OAuth doesn't protect against domain hijacking
3. Updated High-Risk Operations - Focus on actual controls (request signing, short-lived tokens, spending limits) rather than auth mechanism
4. Rewrote Bearer Token Risks - Precise threat/mitigation mapping with reference to threat model

Key Insight

Authentication mechanism alone does not determine security level. A properly implemented bearer token system with short expiry, request signing, and spending limits provides stronger protection than a long-lived OAuth token without additional controls.

What OAuth Does vs Doesn't Provide

Provides:

• Delegated access (user authorizes agent to act on their behalf)
• Scoped permissions
• Token revocation without rotating credentials

Does NOT provide:

• Protection against compromised domains
• Verification that the server is the intended recipient

Actual Mitigations for Domain Trust Threats

Mitigation	How It Helps
TLS Certificate Pinning	Rejects connections even if attacker has valid cert
DNSSEC	Protects against DNS spoofing
Domain Monitoring	Alerts when registration changes/expires
ads.txt/sellers.json	Industry-standard publisher authorization

Test plan

• All existing tests pass
• Documentation builds without broken links
• Review threat model for completeness
• Verify guidance is actionable for implementers

🤖 Generated with Claude Code