v1.0.0 배포 준비: CHANGELOG, LICENSE, 프로젝트 메타 파일 추가

- CHANGELOG.md: Phase 1~13 + 랜딩 페이지 전체 변경 이력
- LICENSE: MIT
- CONTRIBUTING.md: 개발 환경, 코드 표준, PR 프로세스
- SECURITY.md: 보안 정책, 취약점 보고 절차
- .editorconfig: 에디터 설정 통일 (indent, charset, eol)
- .nvmrc: Node.js 20
- .gitattributes: line ending 정규화, 바이너리 선언, linguist 설정
- .gitignore: site/dist, Python, Whisper 모델 등 누락 항목 추가

SECURITY.md

@@ -0,0 +1,34 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 1.0.x   | :white_check_mark: |
+
+## Privacy by Design
+
+D3RO Voice processes all data locally. No audio, text, or telemetry is transmitted to external servers. The application is designed to work completely offline after initial model download.
+
+- **Audio**: Captured and processed in-memory, optionally saved to local SQLite
+- **STT**: faster-whisper runs as a local sidecar process
+- **LLM**: Ollama runs on localhost:11434
+- **License**: One-time online activation, 30-day offline grace period
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability, please report it responsibly:
+
+1. **DO NOT** open a public issue
+2. Email: security@d3ro.dev
+3. Include steps to reproduce and potential impact
+4. We will respond within 48 hours
+
+## Scope
+
+Security concerns include:
+- Local data exposure or leakage
+- IPC channel injection or privilege escalation
+- Unintended network traffic
+- Clipboard data exposure
+- Sidecar process escape