docs(battlenode): document four latent low-tier hygiene hazards

Comment-only; behavior-preserving; 231 BattleNode tests green.

- OutboundSequencer._archive: name the unbounded-per-match growth + ack-prune point.
- NodeCrypto.BuildAes: SECURITY remarks on key-derived IV reuse + base64 entropy loss;
  warn against caching the session key.
- MatchContext/BattlePlayer: FOOTGUN notes on reference-based record equality over the deck list.
- RecordTokensFrom: TRUST note on isSelf/idx overwrite; name the idx>deckCount guard for
  untrusted peers (not added — trusted-LAN today).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

SVSim.BattleNode/Sessions/Dispatch/BattleSessionState.cs

@@ -84,6 +84,11 @@ internal sealed class BattleSessionState
     /// Echo is mined but never relayed.</summary>
     public void RecordTokensFrom(IBattleParticipant from, IBattleParticipant other, object? orderList)
     {
+        // TRUST: isSelf is the SENDER's own perspective flag and idx is unbounded, while RecordToken
+        // overwrites-on-conflict. A buggy/malicious sender could pass isSelf:0 with a deck-range idx to
+        // rewrite the OPPONENT's card identity at a seeded slot. Acceptable for the current trusted-LAN
+        // relay; if peers ever become untrusted, gate on `idx > deckCount` here (generated tokens always
+        // allocate past the deck) so a sender can't forge over seeded deck cards.
         foreach (var (idx, cardId, isSelf) in KnownListBuilder.MineAddOps(orderList))
             RecordToken(isSelf == CardOwner.Self ? from : other, idx, cardId);
     }