Add SECURITY.md and enable private vulnerability reporting #70

Background

The repo has no SECURITY.md: GET /repos/codelitdev/sendlit/contents/SECURITY.md returns 404, and .github/ contains only workflows/. SendLit is an AGPL open-source project that stores customers' contact lists and ESP credentials, and it runs a public OAuth/MCP surface (apps/api/src/auth/better-auth.ts, /mcp). Without a security policy, researchers have no private channel and may file public issues. For example, #59 (a team API key can mint and delete keys over MCP) was filed publicly.

Proposed fix

• Add SECURITY.md:
  • supported versions (latest release, plus hosted app.sendlit.app)
  • how to report: GitHub private vulnerability reporting, plus a security email
  • expected response times and disclosure policy
  • scope, including the hosted service
• Turn on GitHub Private vulnerability reporting for the repo (Settings → Code security).
• Optionally add /.well-known/security.txt on sendlit.app and api.sendlit.app.

Acceptance criteria

• SECURITY.md in the repo root, with reporting channel, response SLA and scope
• Private vulnerability reporting enabled; the "Report a vulnerability" button appears under the Security tab
• security.txt published (optional)