chore: prepare for public release

- add repository/homepage/bugs metadata; target Directus ^11
- genericize internal deployment references
- document install, compatibility, scheduling, security
- stop tracking internal .opencode work artifacts

SECURITY.md

@@ -0,0 +1,22 @@
+# Security
+
+## Access model
+
+- Every `/image-previews/*` endpoint requires an authenticated **Directus admin** (session or admin
+  token). Non-admin requests receive `403`.
+- The admin module is only reachable from the Directus admin app.
+- There is no separate token mechanism and no unauthenticated write path.
+
+## Operational guidance
+
+- Do not expose a production admin token to automation. For autonomous/remote workflows, use a staging
+  instance and least-privilege access.
+- The extension generates transforms in-process; it does not accept image URLs or arbitrary file paths
+  from clients.
+- Persisted state lives under `<STORAGE_LOCAL_ROOT>/.image-previews` and contains no secrets.
+- Uploaded file contents are never logged; only file ids, preset keys, formats, timings, and error
+  messages.
+
+## Reporting a vulnerability
+
+Please report security issues privately to **rawman@locus.im** rather than opening a public issue.