docs(local-llms): add security best practices to OpenClaw guide
10-point security hardening section:
- Known risks table (DM policy, WebSocket, prompt injection, tool exec)
- Gateway config hardening (loopback bind, pairing, disable system.run)
- Windows Firewall rules (block external, allow localhost only)
- WSL2 hardening (UFW, file permissions, no root, disable SSH)
- Network architecture diagram (Tailscale Serve, no port forwarding)
- API key security (OAuth preferred, rotation, no git commits)
- Prompt injection defense (disable browser/system tools, per-channel pairing)
- Monitoring & audit cron script
- Backup & recovery commands
- 14-point pre-launch security checklist
4dd8003f25