Add API design and LLM code security best practices

Two new topic files from research:
- api-design.md: Transport security, OAuth2/JWT/mTLS auth, API patterns
  (versioning, pagination, idempotency, rate limiting), input validation,
  secrets handling, zero-trust service mesh patterns. Maps to OWASP API
  Security Top 10.
- llm-code-security.md: Common vulnerabilities in LLM-generated code
  (injection, hardcoded secrets, hallucinated packages, over-permissive
  defaults, IaC risks, crypto mistakes). Includes per-technology review
  checklists and cites 18 research sources (2024-2026).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

BESTPRACTICES.md

@@ -23,4 +23,6 @@ Generalised best practices extracted from real project work via the `/distill-be
 - [Docker UID Matching](docker-uid-matching.md) — UID wrapper entrypoint for mounted volumes, gosu pattern, when to use vs K8s securityContext
 - [Database Selection](database-selection.md) — SQLite is not a production database; always use PostgreSQL for services with FQDNs, multiple consumers, or concurrent access
 - [Docker](docker.md) — gosu PID 1, GIT_SSH_COMMAND scope, slim image health checks, buildx local images, default users, TTY flags, UID resolution
+- [API Design](api-design.md) — Transport security, auth (OAuth2/JWT/mTLS), versioning, pagination, error handling, idempotency, rate limiting, input validation, zero-trust patterns
 - [Octopus Process Templates](octopus-process-templates.md) — OCL syntax, step template references, channel scoping, parameters, versioning, Platform Hub patterns
+- [LLM Code Security](llm-code-security.md) — Security vulnerabilities in AI-generated code: injection flaws, hardcoded secrets, hallucinated packages, over-permissive defaults, IaC risks, crypto mistakes, review checklist