docs: record which SNMP communities are actually rotated

[Gerrrt]

What changed

Documentation only. Records which SNMP communities are actually rotated on the
hardware — three of the four were, and nothing in the repository said so — and
folds what the rotation taught us back into its runbook.

Why

Closing the loop on #9, which the rotation runbook's §3 requires and which was
never done. SECURITY.md still asserted the communities were "not yet rotated
on the devices". That is materially false for pfSense, the APC NMC and iLO:
each answers to its own distinct new community and refuses the old shared one.

It is still true for the MokerLink switch, but not for the reason the issue
assumes. neo has never answered an SNMP poll at all —
max_over_time(up{job="snmp",instance="10.7.7.2"}[30d]) is 0 across 23,070
samples, so the failure predates the rotation. That is now tracked separately
in #22, and #9 stays open behind it: until the switch answers,
snmp-verify.sh --old returns SKIP for it, so whether it still accepts the
leaked community is unknown rather than proven clean.

A published SECURITY.md that understates what is fixed is as misleading as
one that overstates it.

Two things found en route:

• docs/security.md claimed "SNMP is only reachable on the management VLAN".
  It is not — neo is polled at 10.7.7.2 on the switch-management LAN.
• The runbook's close-the-loop list named three files and missed
  docs/security.md, which is the file SECURITY.md delegates detail to.

Blast radius

None. No rendered config, no secret, no compose service, no Prometheus target
changes. neo is deliberately left in prometheus/targets/snmp.yaml — removing
it to silence SnmpTargetUnreachable would be hiding the problem.

• No change to network segmentation or firewall rules
• No new port published to a VLAN that could not already reach the service
• No credential added outside secrets/*.sops.yaml

Verification

./scripts/validate.sh — all checks pass (yamllint, markdownlint-cli2 and
gitleaks SKIP as not installed on this host; markdownlint-cli2 run
separately via npx, 0 issues).

Live state, re-established immediately before this PR, since the merged wording
asserts it:

$ ./scripts/snmp-verify.sh

Current community
  PASS morpheus   10.0.99.1    "pfSense morpheus.matrix.elysium 2.8.1-RELEASE ...
  PASS mjolnir    10.0.99.10   "APC Web/SNMP Management Card (MB:v4.2.9 PF:v2.0...
  FAIL neo        10.7.7.2     no response (wrong community, filtered, or down)
  PASS shiva      10.0.30.10   "Integrated Lights-Out 4 2.82 Feb 06 2023"

./scripts/snmp-verify.sh --old has since been run interactively (it needs a
terminal by design) and confirms it — rejected for morpheus, mjolnir and
shiva, SKIP for neo. Full output attached to #9:

Old community (must be refused)
  PASS morpheus   10.0.99.1    rejected
  PASS mjolnir    10.0.99.10   rejected
  SKIP neo        10.7.7.2     current-community check failed; a timeout here would prove nothing
  PASS shiva      10.0.30.10   rejected

• make validate passes
• Deployed to the lab and confirmed working — n/a, nothing rendered changes
• Docs updated (docs/, service README, or docs/roadmap.md)

Refs #9, #22