docs: add security architecture assessment and SPA/BFF guide

[soumyaray]

Summary

• Adds a Tyto-specific security architecture assessment that evaluates whether the project needs a Backend-for-Frontend (BFF) layer. The assessment concludes that Tyto's existing same-origin Roda backend already provides the structural benefits of a BFF — secrets and authorization enforcement live server-side, not in the browser. Rather than an architectural redesign, the document recommends targeted hardening of the current implementation, grouped by priority.
• Adds a general-purpose reference guide on securing Single-Page Applications using the BFF pattern, which informed the Tyto-specific assessment.

Documents

• Tyto Security Architecture Assessment
• SPA Security & BFF Pattern Guide