docs: clarify local-first defaults and hosted operations

[sammargolis]

Summary

• documents local-first as the default operating model
• adds hosted operations runbook and security review checklist
• updates contributing guidance and env examples for hosted flags and branch conventions

Security impact

• clarifies required hosted safeguards and release controls
• improves operator guidance for secure deployment and incident response

PHI handling impact

• documents PHI-safe operating expectations and validation gates
• no runtime code-path PHI behavior changes

Tests executed

• docs/config updates only
• verified repository checks still pass on branch stack (pnpm build:test, pnpm test:no-phi-logs)

Rollback plan

• revert this PR to restore previous documentation state