Correct Okta-session-reuse claim; expand threat model

[jgowdy-godaddy]

Summary

The headline fix: `THREAT_MODEL.md` T11 and `DESIGN.md` §Okta Session Reuse Status both previously claimed that transparent Okta session reuse was disabled. It is actively implemented. After a successful `awsenc auth`, the Okta `/authn` session token is cached as ECIES ciphertext alongside the AWS credentials (cache flag `FLAG_HAS_OKTA_SESSION`), and `awsenc serve` calls `try_transparent_reauth` to refresh expiring AWS creds silently — without prompting for MFA — for the lifetime of Okta's session.

This PR rewrites both sections to describe the real behavior and its trust model, then expands the threat inventory with seven new entries discovered during the same audit pass:

• T12 SAML / STS parser hardening (`scraper` HTML parser with tiered form selection, `roxmltree` for SAML and STS XML, chunked-TE size enforcement)
• T13 256 KB response-size cap enforced on both `Content-Length` and streaming
• T14 local `config.toml` tamper redirecting Okta authentication to a lookalike IdP
• T15 concurrent `awsenc serve` race (duplicate STS traffic; atomic write ensures cache integrity)
• T16 cache rollback to an earlier intact ciphertext — bounded by server-side STS `Expiration`
• T17 PATH hijack surface — currently minimal (no `$BROWSER` / `gh` / `open` path yet), future work must use `enclaveapp-core::bin_discovery`
• T18 Type 1 trusted-consumer boundary — the AWS CLI is in the TCB once credentials cross the `credential_process` stdout pipe

Test plan

• Docs-only change; CI should pass cleanly.