chore: add security pentest reports and remediation plan

Overnight pentest run produced recon, analysis, exploitation reports,
and a full security assessment. Plan.md updated with 22 prioritized
fix items for auth, SSRF, injection, XSS, and hardening.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/overnight-loop.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+cd /Users/dorian/Projects/archy
+
+while true; do
+  claude -p "Read .claude/plans/reflective-meandering-castle.md — execute the next task not marked [DONE]. After completing, deploy with ./scripts/deploy-to-target.sh --live, mark it [DONE] in the plan file, commit and push. If all tasks are [DONE], write a summary report and exit." \
+    --max-turns 50 \
+    --allowedTools "Edit,Write,Bash,Read,Glob,Grep,Agent,WebFetch,WebSearch"
+
+  echo "--- Loop iteration complete, restarting in 10s ---"
+  sleep 10
+done