Threat Model

Canonical document: `threat-model.md`.

This file exists because both spellings are referenced. The content lives in the lowercase file so there is exactly one copy to keep correct.