feat(approuter): serve .well-known/security.txt + automate upstream drift check

[jung-thomas]

What

Serve SAP's canonical security.txt (RFC 9116) from our approuter, and automate keeping it in sync with SAP's upstream.

Why

• https://developers.sap.com/.well-known/security.txt returns 200 today — but from the AEM/Akamai edge, which is being decommissioned. Our own approuter returns 404 for that path (the /.well-known/* route proxies to CAP srv-api, which serves only oauth-* + agent-card.json). Once the vanity host points fully at our origin, security.txt disappears unless we serve it.
• github.tools.sap/sgsc-engineering-and-automation/securitytxt (SGSC PSRT) is the source of truth, not a push service — its README says business owners own deployment. So we serve the content and auto-detect upstream changes.

How

• approuter/lib/security-txt.js — (req,res,next) handler + exported canonical constant. Modeled exactly on approuter/lib/well-known-oauth.js. Served as insertMiddleware.first so it survives the content-rebuild tarball swap that wipes approuter/static/ (a Hugo static file would not).
• approuter/server.js — wired right after wellKnownOAuthHandler.
• .github/workflows/security-txt-drift.yml — weekly (Mon 05:19 UTC) + workflow_dispatch + PR-path trigger. Diffs our copy against https://www.sap.com/.well-known/security.txt (SAP's public mirror; the internal repo is unreachable from GitHub.com runners). On drift it opens/updates a PR (GitHub App token, USE_GITHUB_APP gated) — never auto-merges/deploys.
• scripts/check-security-txt-drift.cjs — fetch + compare, exit 2 on drift; npm run check:security-txt-drift.
• Tests: test/unit/security-txt.test.js (7 cases) + a live smoke assertion in test/smoke/seo-files.test.js.

Verification (all green locally)

• vitest run test/unit/security-txt.test.js test/unit/well-known-oauth.test.js → 21 passed (oauth unaffected).
• Handler-chain probe (real handlers, server.js order): /.well-known/security.txt → 200 text/plain; oauth-protected-resource / oauth-authorization-server → 200 JSON; HEAD → 200 no body.
• node scripts/check-security-txt-drift.cjs → exit 0 (matches upstream); stale-constant probe → exit 2 with captured upstream.
• Drift-PR content regeneration tested (multi-line incl. a new Encryption: field) → byte-identical to upstream.

Deploy note

Approuter-only change. Requires a full approuter deploy (npm run deploy -- --env <env>, no --skip-build) — the middleware ships with the approuter module. Roll DEV → verify → PROD.