docs: add audit.md threat model + protocol-by-protocol security notes (closes #5)

[abhicris]

Closes #5.

Lands a substantive docs/audit.md that gives downstream integrators the information a security-minded evaluator actually needs: adversarial model, tolerance bounds protocol-by-protocol, post-quantum assumptions, deployment-level controls, and an honest audit-status statement.

Structure

1. Threat model — static, malicious, rushing adversary; what is and isn't modelled (adaptive corruption, DoS, physical side channels); network and randomness assumptions; pointer to the echo-then-agree broadcast primitive in docs/Broadcast.md.
2. Protocol-by-protocol security notes for every protocol in the tree:
   • CMP — CCS 2020 / eprint 2020/492 (and the 2021 update eprint 2021/060), t - 1 out of n dishonest-majority, Paillier + Strong-RSA + ROM assumptions, caveat that identifiable abort is only identifiable against the reference implementation.
   • FROST — SAC 2020 / eprint 2020/852 + the two-round OMDL analysis eprint 2023/899, t - 1 out of n, targets the committed-nonce-pair variant (not the vulnerable single-nonce FROST1), BIP-340 / SR25519 serialization notes.
   • LSS — Seesahai 2025, composes over CMP, dishonest-majority bound plus the reshare-cohort intersection requirement, rollback caveat (do not roll back past a compromise-triggered reshare).
   • Doerner — IEEE S&P 2018 / eprint 2018/499, 2-of-2 only, zero fault tolerance (splitting primitive, not BFT), VOLE/correlated-OT-based.
   • Ringtail — lattice, M-LWE / M-SIS, explicit warning that it has not been independently audited and is younger than classical schemes; hybrid-mode guidance.
3. BFT tolerance bounds — quick reference table and an explanation of why threshold signing uses t - 1 out of n rather than t < n/3 (BFT-consensus bound), plus what changes when you compose with a BFT layer.
4. Post-quantum assumptions — classical protocols don't survive Shor; Ringtail relies on M-LWE / M-SIS; hybrid-mode recipe (compose with ML-DSA / Dilithium) and an in-place migration path.
5. Deployment considerations — share storage, refresh cadence, HSM integration (cross-linked to docs/hsm-integration.md from the HSM PR), audit logging, secure channels, broadcast.
6. Audit status — no external audit yet (honest); upstream primitive audits (secp256k1 via decred/dcrd, Paillier adapted from taurushq-io/multi-party-sig, Ed25519 via filippo.io/edwards25519, BLAKE3 via lukechampine.com/blake3); responsible-disclosure process at security@lux.network; empty audit log table ready for future entries.
7. Further reading — links to the existing Threshold.md, FROST.md, Broadcast.md, protocols/lss/README.md, and the companion hsm-integration.md.

Cross-checks

• Protocol claims verified against the package headers and Keygen / Sign / Refresh signatures in protocols/cmp/cmp.go, protocols/frost/frost.go, protocols/lss/lss.go, protocols/doerner/doerner.go, and protocols/ringtail/ringtail.go.
• FROST SR25519 caveat traced to the existing protocols/frost/frost_sr25519_test.go.
• Curve / Paillier parameter notes traced to docs/Threshold.md and the pkg/paillier/ implementation.
• No claim is made that any primitive has been audited in the context of this library; upstream audits are called out only as covering the primitive in isolation.

Relation to PR #7

There is an existing PR #7 on this repo (from the kcolbchain fork) that lands a shorter, lighter audit.md plus README link fixes. This PR subsumes the content of that one — same honest audit-status framing, same upstream-primitive attribution, same responsible-disclosure process — but adds the threat model, protocol-by-protocol detail, BFT bounds, PQ discussion, and deployment-considerations sections that issue #5 evaluators actually need. Happy for maintainers to pick whichever is preferred; I can rebase this atop #7 (or vice versa) or cherry-pick individual sections if splitting is useful.