Privacy model

TODO: this page will explain the privacy posture at the architecture level: local-first by default, no cloud accounts required for core features, encrypted at rest, encrypted between Hub and Companion. It is the technical companion to the marketing privacy page.

Owner: @andy. Cross-reference: BLACK_HAT_AUDIT.md, SECURITY_HARDENING_SPEC.md, the planned independent security audit with Lester Lim, and the Privacy section pages here in the docs.