docs: describe the anonymous weekly usage report in Security

[enoch85]

docs/Security.md claimed "no telemetry, and no analytics - Maintainerr never phones home" and gave a closed list of outbound destinations. Both go stale when Maintainerr#3582 ships.

File	Change
docs/Security.md	Locality bullet retitled and rewritten: configuration and state still stay on the user's hardware, but the outbound list now names telemetry.maintainerr.info alongside the configured services and the metadata providers
docs/Security.md	New bullet for the report itself: what it covers, that counts are ranges, that it carries no identifier and nothing from the library, that it is on unless turned off, and the three ways to turn it off (the prompt, Settings > About > Help us improve it, TELEMETRY=off). Detail is left to the collector repo
docs/Installation.mdx	TELEMETRY row in the environment variable table

Versioned snapshots

Left untouched, on your call. 3.22.0, 3.22.1, 3.23.0 and 3.24.0 all still carry the old claim, and it was true for each of them: the report ships after 3.24.0, so no released version phones home. I had drafted a short forward-pointing admonition in each and reverted it.

Worth a second thought before this merges, since the report is on by default: someone running 3.24.0 reads "never phones home" on the version selector's default page, upgrades, and starts reporting. If you want that covered, the cheapest fix is a note in the 3.24.0 snapshot only, added when the release that ships telemetry is cut.

Notes

• docs/API.md and docs/ReverseProxy.md mention BASE_PATH and UI_PORT in prose but carry no variable table, so there is nothing to add there. A grep of docs/ for telemetry, analytics, phones home and outbound turns up no other stale claim.
• Wording checked against feat/telemetry-client, not the PR description: enabled() is process.env.TELEMETRY === 'off' ? false : telemetryEnabled !== false, and the About entry point is labelled "Help us improve it".
• npm run build is clean. onBrokenLinks is warn in this repo rather than throw, so I also confirmed in the built HTML that the new Security.md#how-maintainerr-handles-your-data link resolves to a real anchor and stays inside the same docs version.