docs(acl): threat model and conventions say app commands are ACL-gated

Task 2 already closed the risk (build.rs declares a Tauri AppManifest and
gates every app command per window); this task brings the docs in line so
the threat model of record no longer claims app commands are ungated or
that any local window can call any app command.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

app/src-tauri/src/file_viewer/mod.rs

@@ -3,6 +3,10 @@
 //! Every window is a `file-viewer-<n>` label registered in [`registry::ViewerRegistry`];
 //! the commands in `commands/file_viewer_commands.rs` gate on the label and act only on
 //! the caller's own entry, which is why nothing here takes a path from a window.
+//!
+//! `file-viewer-*` is also the `windows` glob of `capabilities/file-viewer.json`, which grants
+//! exactly the five `viewer_*` commands and nothing else. Labels are minted only here; a window
+//! created anywhere else with a matching label would inherit those grants.
 
 pub mod poll;
 pub mod registry;