docs(SECURITY): document the desktop application threat model

The single-user, localhost-only desktop build changes several security
assumptions from the multi-tenant web deployment: 127.0.0.1-only
binding, per-install random ADMIN_SECRET in the OS keychain (no
DEBUG_MODE bypass path at all, unlike the web deployment), OS-keychain
credential storage instead of .env, restricted CORS, validated dataset
imports, and signature-verified updates.

Existing web-deployment security policy is unchanged.

SECURITY.md

@@ -59,6 +59,35 @@ secrets in workflow logs.
 
 ---
 
+## Desktop Application Threat Model
+
+The desktop build (in development -- see PHASE_ROADMAP.md) is single-user
+and localhost-only, which changes several assumptions from the web
+deployment above:
+
+- **Backend binds to `127.0.0.1` only**, never `0.0.0.0` -- the local API is
+  not reachable from the LAN or any other device, unlike the web deployment's
+  Docker container (which correctly binds `0.0.0.0` for its context).
+- **`ADMIN_SECRET` is generated randomly per install** and stored in the OS
+  credential store (Windows Credential Manager), not left unset. The web
+  deployment's `DEBUG_MODE` auth-bypass path for `admin.py` (documented
+  behavior: unauthenticated `POST /admin/pipeline` when `ADMIN_SECRET` is
+  unset and `DEBUG_MODE=true`) is not present in desktop builds at all --
+  there is no bypass path to accidentally leave enabled.
+- **API keys and Neo4j credentials (when using Online mode) are stored in the
+  OS keychain**, not a plaintext `.env` file -- never written by the Python
+  backend process itself.
+- **CORS is restricted to the desktop app's own origin**, not the GitHub
+  Pages origin used by the web deployment.
+- **Dataset imports are validated before touching the graph** -- file
+  type/size checks, no arbitrary code execution from imported data (no
+  `eval`/`pickle` anywhere in the import path), path-traversal checks on any
+  user-supplied file path.
+- **Update packages are signature-verified** (Ed25519) before being applied
+  -- a corrupted or tampered download will not install.
+
+---
+
 ## Supported Versions
 
 Security fixes are applied to the current state of the `main` branch.