docs: clarify security scope and hardening guidance

[sebastianwessel]

Summary

• add new docs page: Security Model & Hardening
• clarify project scope: wrapper/sandbox layer vs upstream QuickJS engine vulnerabilities
• add practical defense-in-depth recommendations for production deployments
• link the new guidance from:
  • docs/index.md
  • docs/basic-understanding.md
  • docs/fetch.md

Why

Issue #99 raised concerns around QuickJS exploitability. This change documents the threat model clearly and provides concrete hardening guidance for users running untrusted code.