feat: add remote workspaces and verified deliverables

docs/security.md

@@ -38,12 +38,14 @@ chosen SSH configuration read-only, and moves Docker access to an SSH-connected
 execution host.
 
 Workspace paths are normalized and rejected if they escape `/workspace`.
+File browsing and downloads use the same identity boundary. Single-file
+downloads are bounded to 128 MiB by default; directory archives are streamed.
 
 ## Deployment secrets
 
 Secrets live only in a mode-600 deployment `.env` outside Git. Images contain
-no provider or infrastructure credentials. Any API key pasted into a chat
-should be rotated before deployment and the replacement placed in `.env`.
+no provider or infrastructure credentials. Provider credentials are never
+returned to the browser, logged by application code, or committed to Git.
 
 The Web image is rebuilt from a commit-pinned Open WebUI release on
 digest-pinned Node and Python bases. RAG/vector, cloud storage, media model,
@@ -64,8 +66,8 @@ remediate them.
 
 ## Remaining hardening before hostile public use
 
-Local Docker provides process and filesystem isolation, but the Docker daemon
-remains a high-value boundary. Before treating the service as hostile
-multi-tenant infrastructure, move workspaces to the dedicated physical
-execution host, add egress policy, image signing/scanning, central audit
-retention, backup/restore tests, and resource-abuse alerts.
+Workspaces run on a dedicated physical Docker host, separated from the public
+web and database services. The Docker daemon remains a high-value boundary.
+Before treating the service as hostile multi-tenant infrastructure, add
+per-workspace egress policy, image signing, central audit retention,
+backup/restore drills, quotas, and resource-abuse alerts.