Initial Coworker app scaffold

docs/security-review.md

@@ -0,0 +1,19 @@
+# Security Review
+
+## Current State
+
+Coworker starts from a local-first security model:
+
+- Web/PWA access is opt-in.
+- Pairing tokens are hashed before storage.
+- Workspace file access is path-confined.
+- Model endpoints are user-configured local or OpenAI-compatible URLs.
+
+## Required Checks Before Release
+
+- Verify web access is disabled by default.
+- Verify unauthenticated web API requests return `401`.
+- Verify paired device tokens are not stored in plaintext.
+- Verify workspace reads reject path traversal.
+- Verify build artifacts exclude local app data and repository maintenance files.
+- Run scheduled security scan in Gitea Actions.