Expand SECURITY.md with client-side data handling notes

[sshdopey]

Context

SECURITY.md covers reporting, but the app stores the address and wallet id in localStorage and signs transactions client-side, which deserves a documented policy.

Scope

• Document what is stored client-side, the no-secrets rule, and the wallet-signing trust model.

Acceptance criteria

• SECURITY.md describes client-side data handling and the signing model.

Pointers

SECURITY.md, src/wallet/WalletProvider.tsx.

[nice-bills]

@nice-bills has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hi , I'd like to work on this issue.
I'm a full-stack developer experienced in TypeScript, Rust, and smart contract development across EVM and Soroban/Stellar ecosystems. I've built and shipped production systems covering backend APIs, frontend interfaces (Next.js, React), CI/CD pipelines, and onchain protocols so I'm comfortable working across whatever layer this issue touches.
My approach
I'll start by reproducing the issue locally and reading the surrounding code to understand context and constraints. I'll scope the fix tightly to avoid unnecessary churn, write or update tests to cover the change, and make sure linting, formatting, and existing CI checks all pass before opening a PR. If anything in the issue is ambiguous, I'll flag it early rather than guess.
What you can expect is a single clean PR with a clear description linking back to this issue. Minimal, well-tested changes that follow the project's existing conventions. Fast turnaround, I'm available to start immediately and responsive to review feedback.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @nice-bills to this issue.