docs: scope the loopback bind to remote reach (#33)

[AltanS]

Closes the documentation half of #33.

ARCHITECTURE.md §6 called the loopback bind load-bearing without saying against whom. It bounds
remote callers; locally it bounds nothing, because a TCP port is shared by every uid in the network
namespace while herdr's socket is uid-bounded by file permissions. So an agent deliberately run under
another uid to contain it can still curl 127.0.0.1:$COLLIE_PORT and drive any pane in the herd —
installing Collie silently removes the boundary an operator running untrusted diffs is most likely to
have reached for. §6 now says that, and points at the device gate as the one write gate that doesn't
rest on "local means trusted".

Two claims also corrected:

• §6 said the owner login is "asserted and any other tailnet user rejected". checkAccess only
  rejects a mismatching Tailscale-User-Login and passes an absent one — fine under
  tailscale serve, which injects it on every request; not fine behind anything that stops. The
  README's "reject anyone but you" had the same gap.
• Records that the device gate fails closed since 0.15.0 (fix(bridge): refuse writes when the device header is absent #28), which is the code half of Loopback bind bounds remote reach, not local — and the device gate fails open on an absent header #33, and
  that device ids are proxy-asserted names rather than secrets.

Reported by @simonallfrey.

Added after rebase onto 0.16.0 + #37

Reconciled the identity-gate wording across variants. Variant E (added in 0.16.0, after this
branch was cut) and Variant C each re-derived the same mechanism in different words, and neither said
which way it fails. It fails open: with no injector the login is absent, and checkAccess only
rejects a mismatch, so every request passes the check. That is now stated once in Variant C, with
Variant E pointing at it; both cite the startup warning that fires for exactly this case
(startupWarnings, bridge/server.ts:338).

Variant A's "rejects anyone else" was left alone — it is accurate there, since tailscale serve
always injects the header.

Fixed two broken links to the Security heading. github-slugger strips the ⚠ and the em dash but
keeps the U+FE0F variation selector, so the real anchor is <U+FE0F>-security--read-before-you-run-it
(verified against the rendered page: id="user-content-\357\270\217-security--read-…"). Two of the
three links omitted that codepoint and silently didn't scroll, including the top-of-README Contents
entry; the third carried it as a raw invisible character. All three now use the percent-encoded form
GitHub itself emits. Pre-existing on main, unrelated to #33 — separate commit.

Doc-only — no version bump per CLAUDE.md. All internal anchors re-validated against github-slugger's
actual behaviour; CI green.

Fixes #33

🤖 Generated with Claude Code