sec: harden modal worker, update deployment docs, and add pre-push safety checks

NaturalCAD: document Modal RCE and Auth vulnerabilities

Initial NaturalCAD MVP