Bare minimum functionality. Steam Web API, tag weighting, etc

SECURITY.md

@@ -21,6 +21,7 @@ Do not open a public issue for:
 - Never commit real API keys.
 - Never include real API keys in tests, fixtures, screenshots, logs, or documentation examples.
 - Prefer OS credential storage for Steam and third-party provider keys.
+- Current development builds store the Steam API key in the local SQLite settings database. This is acceptable for the current local MVP but should be revisited before public release.
 - If local plaintext storage is temporarily used during early development, it must be clearly marked as temporary and replaced before release.
 - Logs must redact API keys and tokens.