Security: README security model + deployment hardening + epClientSecret audit (#279 LOW-4 + INFO-1)

[field123]

Parent PRD

#279

What to build

Closing slice for PRD #279. Three small jobs bundled because none of them merit a standalone issue:

1. Security model README section — describe the package's security guarantees after Security: verify EP account token in /ep/account/login (#279 HIGH-1) #280–Security: apply Origin-allowlist gate to cart routes (#279 MEDIUM-2) #287 land: HttpOnly JWE session, server-side cart routes, opt-in browser token surface, Origin-allowlist gates on proxy + cart, host allowlist on bundle config, account-login token verification.

2. Deployment hardening section (LOW-4) — recommended edge/WAF rules for /api/ep/ep/anonymous (per-IP rate limit, short-cache anonymous responses). No code change.

3. epClientSecret audit (INFO-1) — grep usage; if unused in the package, delete the field from the public config interface. If reserved for future use, document the contract (server-only, never in providerProps()) with an inline comment.

Acceptance criteria

• README has a "Security model" section enumerating the post-fixes guarantees
• README has a "Deployment hardening" section with recommended edge/WAF rules
• epClientSecret is either removed or comment-documented as server-only
• CHANGELOG entry summarizes the breaking changes (tokenSurface default, allowedOrigins requirement) so consumers upgrading aren't surprised

Blocked by

• Blocked by Security: verify EP account token in /ep/account/login (#279 HIGH-1) #280
• Blocked by Security: production-secret guard in createEpAuth + example hard-fail (#279 HIGH-2) #281
• Blocked by Security: remove browser-readable EP token leak (#279 HIGH-3) #282
• Blocked by Security: shared Origin-allowlist gate + production-required allowedOrigins on proxy (#279 MEDIUM-1) #283
• Blocked by Security: sanitize proxy dispatch_failed responses in production (#279 MEDIUM-3) #284
• Blocked by Security: host allowlist on extractEpProviderConfig (#279 LOW-3) #285
• Blocked by Security: middleware cookie parsing + delete dead RSC cookie-write block (#279 LOW-1 + LOW-2) #286
• Blocked by Security: apply Origin-allowlist gate to cart routes (#279 MEDIUM-2) #287

User stories addressed

• User story 10
• User story 11
• User story 12