[P3] Accepted-risk documentation duplicated across two files and drifting from code

[itsmiso-ai]

Problem: Two files document accepted risks with overlapping, inconsistent content: SECURITY-ACCEPTED-RISKS.md (62 lines, "Last updated 2026-07-07") and docs/accepted-risks.md (9 lines, "Last updated 2026-07-15"). The in-memory rate-limiting risk is documented in both with different wording and dates; nothing references docs/accepted-risks.md, so it is a second, orphaned source of truth. The docs also drift from the code: SECURITY-ACCEPTED-RISKS.md claims "npm audit --omit=dev is run on every CI push" (it is not — see the [P2] CI-audit finding) and counts "19 production dependencies" (package.json has 17).

Evidence:

• wc -l → SECURITY-ACCEPTED-RISKS.md 62 lines, docs/accepted-risks.md 9 lines; both contain an "In-Memory Rate Limiting Is Per-Instance" section with different wording and different "Last updated" dates.
• git log: docs(security): close out remaining #495 audit findings #583 added the rate-limit risk to SECURITY-ACCEPTED-RISKS.md; Document in-memory rate limiter tradeoff in docs/accepted-risks.md #624 later created docs/accepted-risks.md for the same risk instead of updating the existing file.
• grep -rn "accepted-risks" . (excluding node_modules/.git) → nothing references docs/accepted-risks.md.
• SECURITY-ACCEPTED-RISKS.md → "The project uses 19 production dependencies" vs Object.keys(package.json.dependencies).length → 17.

Acceptance:

• Consolidate to a single canonical accepted-risks file; the other file links to it (or is deleted).
• Refresh stale facts (dependency count, audit-in-CI claim) in the canonical file.
• Add a lightweight CI lint (or link check) that keeps the two files in sync if both must exist.