feat(config): validate clients and scope security

shared/rules/security-api.md

@@ -0,0 +1,7 @@
+# API security
+
+* Authenticate and authorize protected endpoints; validate every request payload and identifier.
+* Bound request and response sizes, pagination, query results, and expensive operations.
+* Apply rate limits where abuse is plausible and keep administrative endpoints separately protected.
+* Return only authorized data and never expose stack traces, internal models, or implementation details in API errors.
+* Prefer explicit DTOs and schemas over deserializing arbitrary types or executable objects.