Documentation gaps: prerequisites, config table, SECURITY.md, stale ADRs

[jpower432]

Description

A few documentation gaps to address as the project matures. None are blocking, but they'll help new contributors and evaluators.

README

• Add a Prerequisites section (Go 1.25+, Docker/Podman, make, golangci-lint) — CONTRIBUTING.md references it but it doesn't exist yet
• Bring the config table up to date — currently lists 7 of 28+ env vars from internal/config/gateway.go
• Link to the OpenAPI spec — the README shows 4 endpoints but the spec documents 11

Security

• Add SECURITY.md with a vulnerability disclosure process — GitHub surfaces this in the security tab

ADRs

• Audit ADRs that reference old architecture (PostgreSQL, ClickHouse, ConnectRPC, cmd/gateway) and update status fields — external-authz-engine.md was updated to Superseded as a start

[jpower432]

Additional items from cranky-core review (2026-06-24)

The .env.example file is stale — it references ClickHouse, kagent, Google OAuth, MCP servers, and A2A proxy configurations that no longer exist in the codebase. An operator copying .env.example to .env gets zero useful guidance.

Additional checklist items:

• Replace .env.example with one matching the current architecture (28+ vars from internal/config/gateway.go)
• Mark NATS_URL as required (currently all vars are commented out equally)
• Group by subsystem: Server, Tessera, JWT, Cedar, CORS, Blob, NATS tuning, Rate limiting
• Document security implications for TESSERA_WITNESS_FAIL_OPEN and CEDAR_POLICY_DIR
• Add guidance for TESSERA_SIGNER_KEY_PATH (generated by setup-witness.sh, not manually created)