Add the work plan for the code review fixes

Branch: review-fixes-plan → main

What changed

New docs/review-fixes-plan.md: the plan for fixing the findings of the 2026-11-12 source code review, written so an agent can pick up one PR at a time.

Decisions settled on 2026-11-12: a 512 MB decompression limit, the S4 change to bound paths, "A1" pad labels everywhere, 0.5.2 then 0.5.3 as releases, no CI, and the current PR record layout.
Guidelines for agents: branch and PR flow on Gogs, PR records, the checks to run before every push, code rules, and release tagging.
Nine PRs in order, each with its branch name, the findings it fixes, tasks and done criteria. PRs 1-4 ship the security fixes as 0.5.2; PRs 5-9 ship the hardening work as 0.5.3.
Backlog: findings not yet scheduled.

No code changes and no version change.

Notes

PR 8 asks whether to keep minimum-release-age in .npmrc for pnpm; npm 11 warns about it on every install.
PR 4 needs Go 1.27.4 (GO-2026-6859). The VPS repositories offered only 1.27.3 on 2026-11-12.

Testing

Documentation only. go test ./... passes on the server.