docs: keep only reference documentation, archive one-offs

docs/security.md

@@ -29,8 +29,8 @@ Current security posture for XAMXAM.
   so `session.gc_maxlifetime` must be ≥ the 12 h absolute timeout or PHP would
   reap active sessions early.
 - nginx `auth_basic` layer has been removed; the PHP session layer is the only
-  gate. (LDAP-based login is a proposed future enhancement — see
-  [`ldap.md`](ldap.md). It is **not** implemented.)
+  gate. (LDAP-based login is a proposed future enhancement — **not**
+  implemented. See [`ldap.md`](archive/ldap.md).)
 
 ### PHP-FPM session GC configuration
 
@@ -130,7 +130,7 @@ spoofing.
 ## Areas to keep monitored
 
 - Tightening the public CSP (`frame-ancestors 'none'` vs `'self'` on embed
-  routes) is an active topic — see `TODO.md`.
+  routes) is an active topic — tracked in the repo-root `TODO.md`.
 - Sensitive file downloads and their expiry/token handling are worth periodic
   review as usage grows.