docs: Add indieweb2-bastion relationship to IndieWeb security planning

Added references to indieweb2-bastion in both HANDOVER and ROADMAP:

- Infrastructure layer (bastion, provenance) complements application layer
- Provenance graphs for Webmention verification chains
- Bastion patterns for rate limiting endpoints
- Audit logging as first-class feature

Also added SSRF prevention to IndieWeb roadmap (Phase 5.4).

Architecture:
  indieweb2-bastion → Infrastructure (network, DNS, audit)
  php-aegis        → Application (Micropub, IndieAuth, Webmention)
  sanctify-php     → Analysis (static security scanning)

Author: claude

HANDOVER_SANCTIFY.md

@@ -683,6 +683,49 @@ From this integration:
 
 ---
 
+## Related Project: indieweb2-bastion
+
+The [indieweb2-bastion](https://github.com/hyperpolymath/indieweb2-bastion) repository provides infrastructure-layer security that complements php-aegis and sanctify-php at the application layer.
+
+### What indieweb2-bastion Does
+
+| Feature | Purpose |
+|---------|---------|
+| Hardened bastion ingress | Secure network entry points |
+| Oblivious DNS (IPv6) | Privacy-preserving DNS resolution |
+| GraphQL DNS APIs | Programmable domain resolution |
+| SurrealDB provenance graphs | Audit trails & data lineage |
+
+### Relationship to IndieWeb Security
+
+While **not** implementing IndieWeb protocols (Micropub, IndieAuth, Webmention), indieweb2-bastion provides foundational security patterns applicable to IndieWeb infrastructure:
+
+| indieweb2-bastion | IndieWeb Application |
+|-------------------|---------------------|
+| Provenance graphs | Track Webmention verification chains |
+| Audit capabilities | Log IndieAuth token usage |
+| Bastion pattern | Rate limit Webmention endpoints |
+| Policy controls (Nickel) | Define allowed Micropub content |
+
+### Recommended Stack Architecture
+
+```
+┌─────────────────────────────────────────────────────────┐
+│                   Full IndieWeb Stack                    │
+├─────────────────────────────────────────────────────────┤
+│  indieweb2-bastion    │  Infrastructure layer           │
+│  (network, DNS, audit)│  (bastion, provenance)          │
+├───────────────────────┼─────────────────────────────────┤
+│  php-aegis            │  Application layer              │
+│  (validation, escaping)│ (Micropub, IndieAuth, Webmention)│
+├───────────────────────┼─────────────────────────────────┤
+│  sanctify-php         │  Analysis layer                 │
+│  (static analysis)    │  (find vulnerabilities)         │
+└─────────────────────────────────────────────────────────┘
+```
+
+---
+
 ## Final Summary: Integration Value Matrix
 
 | Tool | WordPress Value | Non-WP Value | Unique Capability |

ROADMAP_PRIORITY.md

@@ -148,6 +148,27 @@ Sanitizer::jsonEncode(mixed $input): string  // Safe JSON with flags
 
 **Goal**: First-class support for IndieWeb/semantic web patterns.
 
+### Related Project: indieweb2-bastion
+
+The [indieweb2-bastion](https://github.com/hyperpolymath/indieweb2-bastion) repository provides infrastructure-layer security (bastion ingress, oblivious DNS, provenance graphs) that complements php-aegis at the application layer.
+
+**Architectural relationship**:
+```
+┌────────────────────────────────────────────────┐
+│  indieweb2-bastion  │  Infrastructure layer    │
+│  (network, audit)   │  Rate limiting, logging  │
+├─────────────────────┼──────────────────────────┤
+│  php-aegis          │  Application layer       │
+│  (this module)      │  Micropub, IndieAuth,    │
+│                     │  Webmention validation   │
+└────────────────────────────────────────────────┘
+```
+
+**Lessons from indieweb2-bastion**:
+- Use provenance-style tracking for Webmention verification chains
+- Apply bastion patterns for rate limiting endpoints
+- Consider audit logging as a first-class feature
+
 ### 5.1 Micropub Content Sanitizer
 ```php
 Micropub::sanitizeContent(string $html, array $allowedTags = []): string
@@ -167,6 +188,13 @@ Webmention::validateSource(string $url): bool  // Not internal IP
 Webmention::validateTarget(string $url, string $domain): bool
 ```
 
+### 5.4 SSRF Prevention
+```php
+// Prevent Webmention SSRF attacks
+Webmention::isInternalIp(string $ip): bool
+Webmention::resolveAndValidate(string $url): ValidationResult
+```
+
 ---
 
 ## Phase 6: Rate Limiting (v0.6.0)