Correct the security claims in docs and comments, and record the accepted risks (closes #171)

Docs and comments only; no behaviour change. Corrects ten overclaims the
security review found: snapshot names are hashed but the hash uses no
secret, so a guessed hostname and name can be confirmed; a blob is named
by hex(SHA256(SHA256(uncompressed contents))), stated once in
docs/REPOSTRUCTURE.md and referenced elsewhere; double hashing does not
hide known content (blob packing does); age uses ChaCha20-Poly1305, not
XChaCha20; encryption is required, not optional; a snapshot is marked
complete before its metadata is uploaded; the export comment now matches
its only caller; deep verify detects corruption, not authorship; adding a
recipient does not reach existing data; restore examples target a
user-owned directory.

Adds an Accepted Risks subsection under Security Considerations with the
seven documented risks, cross-referenced from the README.

Model: opus-4-8

internal/types/types.go

@@ -146,8 +146,10 @@ type SnapshotID string
 // Used for content-addressing and deduplication of file chunks.
 type ChunkHash string
 
-// BlobHash is the SHA256 hash of a blob's compressed and encrypted content.
-// This is used as the filename in S3 storage for content-addressed retrieval.
+// BlobHash is hex(SHA256(SHA256(uncompressed blob contents))), computed before
+// compression and encryption (see blobgen.DoubleSHA256 and
+// docs/REPOSTRUCTURE.md). It is used as the filename in S3 storage for
+// content-addressed retrieval.
 type BlobHash string
 
 // FilePath represents an absolute path to a file or directory.