docs(park): record the API-key ruling — leave it as is

Operator ruled 2026-08-18 on the 5-character PARK_API_KEY flagged during
the v1.0.0-beta.2 deploy: leave it. The henge is LAN/WG-internal and
never internet-exposed. Written down so the next audit does not re-raise
a question that has already been answered.

stacks/park/README.md

@@ -14,7 +14,12 @@ deployed at tag **v1.0.0-beta.2** (commit `2c258f7`). Owned by `park-dev`.
   backup source — no per-volume add needed. (⚠ nh3-docker's restic repo was broken as of
   2026-08-12 — see fleet infra notes.)
 - **Secret:** `PARK_API_KEY` from the vault (`secret get nh3-dev/park-api-key`), in the
-  host `.env` (chmod 600). `/healthz` is unauthenticated; `/park/*` needs the bearer key.
+  host `.env` (chmod 600). `/healthz` and the UI shell are unauthenticated, asset GETs
+  under `/ui/assets/` are public, and `/park/*` needs the bearer key.
+  **The key is 5 characters, and that is a settled decision — leave it.** Surfaced to
+  the operator 2026-08-18 with a rotation offer; ruled *leave as is*. The service is
+  LAN/WG-internal and never internet-exposed, so the exposure is "already on the
+  network", not the open web. Do not re-flag this on the next audit.
 - **Health:** `GET /healthz` → `{"status":"ok"}` (image `HEALTHCHECK` built in).
 
 ## Image is built locally (no registry yet)