nanobot

docs: add security config section and remove redundant full config example

refactor(security): lift restrictToWorkspace to tools level

docs: update line count after enhancing security

Merge PR #77: add security hardening (SECURITY.md, workspace restriction for file tools)

refactor: unify workspace restriction for file tools, remove redundant checks, fix SECURITY.md