docs(security-hardening): correct stale "Queued" note (#254)

The section intro claimed only 'Pluggable secrets backend' remained
queued, but that shipped (✅). The two genuinely-remaining items are the
NL->SQL prompt-injection hardening and the EXPLAIN dry-run pre-flight
(both ⬜, both scoped to translate_nl_to_sql). Flag them as the current
top security priority and a natural single focused PR.


Claude-Session: https://claude.ai/code/session_0122yLZLJ8t4W43sdN6BmTZc

Co-authored-by: Claude <noreply@anthropic.com>

Author: devopam

docs/security-hardening.md

@@ -122,9 +122,12 @@ left in place.
 
 ## Queued (next focused PRs)
 
-> Most of this section has now shipped. Only **Pluggable secrets
-> backend** remains queued; the rest are marked ✅ with the landing
-> note inline.
+> Most of this section has now shipped (each marked ✅ with the
+> landing note inline). Two items remain, both small and both scoped
+> to `translate_nl_to_sql` / `mcpg.nl2sql`: **NL→SQL prompt-injection
+> hardening** and **NL→SQL EXPLAIN dry-run pre-flight** (the two ⬜
+> entries below). They're the current top security priority and a
+> natural single focused PR.
 
 ### ✅ HTTP hardening (request limits + security headers + CORS + timeout)
 **Shipped.** Security headers + request-size limit + CORS allowlist