Security launch checklist

# Launch checklist

## Threat model
- Data classified
- Trust boundaries identified
- Abuse cases listed

## AuthN / AuthZ
- Identity provider wired
- Least privilege roles
- Rate limits set

## Data
- Encryption at rest
- TLS everywhere
- PII redaction in logs

## Operational
- Runbook updated
- Monitoring + alerting
- Rollback path tested

## Compliance
- DPIA filed
- Vendor review (if SaaS)
- Audit log emitted