feat: ship phase 1 surface area (v0.2.0)

- primora CLI + @primora/mcp server over generated client
- auth users admin panel, mobile bottom nav
- release workflow: GHCR images, compiled binaries, npm tarballs
- fix gzip Content-Length truncation, nginx upstream re-resolution

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

SECURITY.md

@@ -0,0 +1,21 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Do not open a public issue. Report vulnerabilities privately to the maintainer
+at **[email protected]**. Include reproduction steps and the affected
+component (API, auth service, frontend, or deployment).
+
+You can expect an acknowledgement within a few days and a fix or mitigation
+plan after triage.
+
+## Scope notes
+
+Primora is self-hosted software. Misconfiguration of your own deployment
+(weak secrets, missing TLS, exposed ports) is a deployment concern, not a
+project vulnerability — but hardening suggestions are welcome as normal
+issues.
+
+## Supported versions
+
+The `main` branch only. Self-hosted deployments should rebuild regularly.