Publish /security + /legal pages that never made it over from the app

[Sbussiso]

Why

app.sentinel-command.com/security was reported rendering a blank page. Root-causing it led here: when the app removed its marketing pages (Sentinel-Command 92d6f83, "pages now live on the standalone website"), only the landing page and /documentation were ever published on this site. /security, /legal/terms, and /legal/privacy have 404'd since — while being linked from:

• this site's own footer (Security, Terms)
• the app's sign-up page (Terms of Service + Privacy Policy — a compliance problem)
• the app's pricing FAQ and cookie notice
• SECURITY.md and the RFC 9116 security.txt Policy: URL (/security#vulnerability-disclosure)

The app side is fixed separately (Sentinel-Command branch ui-improvements-and-bug-fixes, commit 3326628): dangling relative links absolutized, legacy paths redirect here, and unknown paths get a proper 404 instead of a blank screen. This PR makes the redirect targets actually exist.

What

Page	Source	Notes
docs/security/index.html	port of the app's SecurityPage.jsx (recovered from git history)	Keeps the load-bearing #vulnerability-disclosure anchor — security.txt and SECURITY.md point at it
docs/legal/terms/index.html	port of LegalPage.jsx TermsContent
docs/legal/privacy/index.html	port of LegalPage.jsx PrivacyContent
docs/404.html	new	Custom GH Pages 404 (was the stock GitHub one); noindex
docs/index.html	one-line fix	Footer "Live App" linked to this site itself; now app.sentinel-command.com

All pages are self-contained static HTML restyled to the site's design system (same fonts, CSS variables, pill nav, footer). Directory-style URLs (/security/) mean the old extensionless links 301 cleanly, fragment preserved.

⚠️ Content deviations from the removed app pages — please review

The ported text is verbatim except:

1. Vulnerability disclosure contact (security page): the old page said "We don't yet operate a security@ mailbox". That predates ImprovMX going live (Command 621114e). Now lists security@sentinel-command.com primary + GitHub Security Advisory secondary — matching security.txt and SECURITY.md exactly.
2. Legal contact sections (Terms §18, Privacy §6/§10/§12): "GitHub issues only; a legal@/privacy@ mailbox will land alongside our custom domain" → support@sentinel-command.com + GitHub issues.
3. Last updated on Terms/Privacy bumped April 24 → July 6, 2026 to reflect (2). If you'd rather keep the old date and revert the contact edits, say so and I'll re-cut it.
4. App-relative URLs absolutized: /.well-known/security.txt and /api/health → app.sentinel-command.com/...; in-scope wording "this site" → "app.sentinel-command.com".
5. The security page's old "Related" links to /docs#api-rate-limits / /docs#security-procedures (targets don't exist in the docsify site) → replaced with /documentation/ + security.txt.
6. The decorative security-hero banner image was dropped — the site has no /images/ assets. (Spec exists at Command docs/image-specs/security-hero.json if you want it regenerated later.)

Not ported (deliberately)

• The old /sentinel marketing page (1,396 lines) — the app now redirects /sentinel here, where the new 404 catches it. Worth its own pass if you want it back.
• A marketing /pricing page — the footer keeps pointing at the app's authenticated /pricing, unchanged.
• Note: og:image on the landing page points at /images/og-card.jpg, which also 404s — pre-existing, untouched here.

Verified

Served docs/ locally and checked all four pages render (nav/footer/tables/tabs), #vulnerability-disclosure resolves, the only mailtos are security@/support@sentinel-command.com, and no stray app-relative links remain.

🤖 Generated with Claude Code