refactor(rules): group focused security rules

shared/rules/security/references/crypto.md

@@ -0,0 +1,6 @@
+# Cryptography and secrets security
+
+* Never implement custom cryptographic primitives or use obsolete algorithms.
+* Use established libraries, authenticated encryption, secure randomness, and verified signatures and certificates.
+* Treat tokens, private keys, connection strings, and credentials as secrets; keep them out of source, URLs, command lines, logs, fixtures, and frontend code.
+* Use environment-appropriate secret storage, separate environments, and rotate compromised credentials.