doc: update and cleanup

docs/security.md

@@ -67,17 +67,19 @@ export SECURITY_RBAC_ENABLED=true
 
 #### Development Certificates
 
-Use the provided test script:
+Use the provided dev-cert script:
 
 ```bash
-./test-mtls-rbac.sh
+./deploy/scripts/generate-dev-certs.sh
 ```
 
-This generates:
-- `ca.pem` / `ca-key.pem` - Certificate Authority
-- `server-cert.pem` / `server-key.pem` - Server certificate  
-- `admin-cert.pem` / `admin-key.pem` - Admin client (OU=platform-team)
-- Various plugin certificates (OU=plugins)
+This generates (under `deploy/certs/`):
+- `ca.pem` / `ca-key.pem` — Certificate Authority
+- `server-cert.pem` / `server-key.pem` — Server certificate
+- `admin-cert.pem` / `admin-key.pem` — Admin client (OU=platform-team)
+- Per-role client certs (OU=automation, OU=plugins)
+
+For an individual client cert without regenerating everything, use `./deploy/scripts/generate-client-cert.sh`.
 
 #### Production Certificates
 
@@ -494,10 +496,9 @@ Charybdis security features support compliance requirements:
 
 ## Next Steps
 
-- 🔌 Configure [Plugins](plugins.md) with proper certificates
-- 🚀 Review [Deployment Guide](deployment.md) for production
-- 📊 Set up [Monitoring](monitoring.md) for security events
+- [Plugins](../plugins/README.md) — configure plugins to use mTLS client certs
+- [Architecture](architecture.md) — interceptor placement and observability hooks
 
 ---
 
-**Security Questions?** Open a [security issue](../../security) (for vulnerabilities, use private disclosure).
+**Security Questions?** Open an issue (for vulnerabilities, use private disclosure).