Move security before skill setup and fix form routing

[TeoSlayer]

Summary

• places the Security Foundation directly before the homepage skill-injection section
• keeps the plain-text page in the same semantic order
• moves website form handlers from /api to /forms so the existing release Worker does not intercept submissions

Validation

• npm run check:plain
• npm run build
• npm run check:site
• Pages Functions bundle
• local method and validation tests for both /forms endpoints
• browser verification that the sections are directly adjacent

[github-actions]

🚀 Preview deployed to Cloudflare Pages

• Commit deploy URL: https://41203464.pilotprotocol.pages.dev
• Branch alias: https://codex/security-before-skills.pilotprotocol.pages.dev (may take ~30s to propagate)
• Commit: b19d4dd960b7e2845ae422923ff9cd4947922e9f