docs(security): draft MCP-exposure threat model (AI-authored, pending human sign-off)

Inventories every crypto primitive in the `januskey-cli` crate with file:line
anchors (AES-256-GCM AEAD, Argon2id KDF, SHA-256 hash, home-rolled HMAC,
thread_rng CSPRNG, Ed25519/X25519 declared-but-unimplemented), enumerates 14
plausible MCP tools (mirroring boj-server/cartridges/cloud-mcp shape), and
applies STRIDE + 9 crypto-specific threat classes including the agent-as-
adversary primary class.

Verdicts: 3 safe-to-expose (status, audit_show, audit_history),
8 requires-constraint (list, show, generate, rotate, revoke, backup,
audit_verify, audit_export), 3 DO-NOT-EXPOSE (retrieve_key, init, unlock).

Draft only — requires Jonathan's sign-off on 7 decisions captured in
~/Desktop/YOUR-ACTIONS-todo.md §18 before any januskey-mcp cartridge wires.
AI-WORK-todo.md §3c januskey row updated to point here.

Pre-exposure code fixes flagged (AI-wire-able after approval):
- Replace home-rolled HMAC in attestation.rs:182-191 with hmac::Hmac<Sha256>
  (currently length-extension vulnerable — audit_verify can false-positive)
- Emit AlgorithmNotImplemented for Ed25519/X25519 until real impls land
- Add via_mcp + agent_session_id fields to AuditEntry
- Centralise crypto errors to a single opaque CRYPTO_FAILED at the boundary
- Design + ship Gossamer passphrase-entry panel before any MCP unlock tool

SPDX: PMPL-1.0-or-later (MPL-2.0 legal fallback).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath