chore(vercel): RFC 9116 canonical /security.txt → /.well-known/security.txt 301 (#3326)

Per agent-readiness epic #3306 follow-up: legacy /security.txt
path was returning the SPA shell (text/html) because of the
catch-all rewrite. Add a permanent redirect so both apex and www
emit 301 → /.well-known/security.txt, matching RFC 9116 §3.

No-op for the canonical /.well-known/security.txt path, which
already serves correctly.

vercel.json

@@ -2,7 +2,8 @@
   "ignoreCommand": "bash scripts/vercel-ignore.sh",
   "crons": [],
   "redirects": [
-    { "source": "/docs", "destination": "/docs/documentation", "permanent": false }
+    { "source": "/docs", "destination": "/docs/documentation", "permanent": false },
+    { "source": "/security.txt", "destination": "/.well-known/security.txt", "permanent": true }
   ],
   "rewrites": [
     { "source": "/docs/:match*", "destination": "https://worldmonitor.mintlify.dev/docs/:match*" },