docs: close out the SNMP rotation, residual and all

[Gerrrt]

Final state of #9. All four devices rotated; one residual recorded as an accepted risk rather than left as an open question.

What changed

SECURITY.md, docs/security.md and docs/roadmap.md all still described the
switch as not rotated and not answering SNMP. Both are now false.

Where it actually landed

Device	New community	Old community
pfSense morpheus	answers	refuses
APC mjolnir	answers	refuses
iLO shiva	answers	refuses
MokerLink neo	answers	still accepted

neo is rotated and polling. It also still accepts the community it held
before the rotation. That was verified after a reboot, so it reflects the
switch’s saved configuration rather than a stale agent — the firmware does not
persist a deletion from the SNMP community table.

Why this is accepted rather than fixed

Each removal attempt also drops the SNMP agent until the switch is rebooted,
and it is the switch the entire network runs through. The cost of continuing
exceeds what it buys:

• the community is read-only;
• reaching UDP/161 on 10.7.7.2 requires both a foothold on the management
  VLAN and the specific pfSense rule permitting 10.0.99.20 to reach it.

Recorded rather than quietly dropped, which is the standard SECURITY.md
already sets for the exposures above it. The roadmap item is narrowed from
"finish the rotation" to "overwrite that row with a fresh value rather than
deleting it, next time the switch is down anyway" — the workaround for a
firmware that will not persist a delete.

Unchanged and still open: the original shared community remains in git history
and must be treated as public.

Blast radius

Documentation only.

• No change to network segmentation or firewall rules
• No new port published to a VLAN that could not already reach the service
• No credential added outside secrets/*.sops.yaml

Verification

$ ./scripts/snmp-verify.sh
  PASS morpheus / mjolnir / neo / shiva     all four answer their own community
up{job="snmp"}   all four = 1,  neo reporting 26 ports

./scripts/validate.sh passes, markdownlint-cli2 clean.

• make validate passes
• Deployed to the lab and confirmed working
• Docs updated

Closes #9