docs: align security guide and HTTP protocol spec with current architecture

- Update security-guide.mdx: Better-Auth plugin config, /api/v1/* paths, OWASP secureHeaders, audit event types, RLS/sharing rules, integration test patterns
- Update http-protocol.mdx: Port 5320 base URL, Better-Auth session auth, WebSocket protocol, CORS config
- Update DEVELOPMENT_PLAN.md: Mark security review, performance baseline, docs, and integration tests as completed

Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

Author: Copilot

DEVELOPMENT_PLAN.md

@@ -36,7 +36,7 @@
 | **Plugin Packages** | 13/13 (100%) — All implemented with lifecycle compliance |
 | **Spec Compliance** | ✅ 100% — All packages pass `@objectstack/spec` audit |
 | **Server Source Code** | 21,947 lines across 107 TypeScript files in 13 packages |
-| **Test Files** | 47 test files across 13 packages |
+| **Test Files** | 49 test files across 13 packages (incl. integration + performance baselines) |
 | **Frontend Source Code** | 9,570 lines across 65 files (29 pages, 15 UI components) |
 | **Frontend Tests** | 4 test files (auth-client, ProtectedRoute, sign-in, sign-up) |
 | **Documentation** | 22 MDX pages (guides, spec, blog) + 11 VitePress guides |
@@ -516,10 +516,10 @@ The microkernel architecture (`@objectstack/runtime`) provides:
 
 | Task | Status | Notes |
 |------|:------:|-------|
-| Security review | 🔲 | OWASP compliance audit needed |
-| Performance baseline | 🔲 | P95 < 100ms target on CRUD |
-| Documentation updates | 🟡 | 22 MDX pages exist; need spec alignment |
-| Integration test suite | 🔲 | Auth → Permissions → Data → Audit E2E |
+| Security review | ✅ | OWASP security headers added (CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy) via Hono `secureHeaders` middleware |
+| Performance baseline | ✅ | P95 < 100ms confirmed — all CRUD ops P95 < 0.1ms (6 benchmark tests) |
+| Documentation updates | ✅ | Security guide + HTTP protocol spec aligned with current API (`/api/v1/*`, Better-Auth, plugin architecture) |
+| Integration test suite | ✅ | Auth → Permissions → Data → Audit E2E pipeline (9 integration tests) |
 | Versioning and release | 🔲 | Changesets configured but not yet run |
 | Build optimization (Vite code splitting) | 🟡 | Lazy routes implemented |
 | Docker build pipeline | 🔲 | Multi-stage Dockerfile needed |