docs(security): document authentication and API security model (#189)

[Aboyeji-Isaac]

Summary

Adds a source-grounded security reference for contributors building or reviewing protected SwiftChain API endpoints.

Closes #189

Changes

• Document JWT issuance and expiry behavior
• Explain the difference between payload-only token verification and DB-backed route authentication
• Document RBAC roles and the existing authenticate / requireRole middleware order
• Record the global and named rate-limit defaults
• Document idempotency-key behavior, replay handling, and conflict responses
• Document CORS behavior
• Document Helmet protections including CSP and HSTS
• Document PII masking and logging expectations
• Clarify that secrets and raw passwords must not be logged
• Document the current refresh-token reality
• Add a checklist for implementing protected endpoints safely

Tested

Remote source-to-document verification confirms the documented controls and defaults match the current codebase.

The branch is based on current upstream main and changes only backend/docs/security.md.

No runtime code changed.

[drips-wave]

@Aboyeji-Isaac Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[Tybravo]

@Aboyeji-Isaac

Well-done work
Thank you for your contribution