re-review security report (index model, /tax, curl_cffi, CI secret); move to docs/

raise test coverage to 100% (152 tests)

serve cross-country comparisons from an offline numbeo cache

harden numbeo fetch with browser headers, cookie priming and retry

split dense README into docs/ (architecture, testing, deployment)