refactor(config): audit API surface + deprecate ipinfo_* fields (O3)

[rennf93]

Summary

Design-partner feedback O3 — a scoped audit + targeted, non-breaking tightening of the guard-core public API surface. No field removed, no detection/middleware behavior changed.

Audit (docs/internals/api-surface-audit.md)

A full inventory of the public surface with a recommended action per item:

• All 90 SecurityConfig fields, grouped by domain, each with a keep/deprecate/group/remove recommendation and models.py line.
• Field counts by domain; the 13 validators + to_agent_config.
• Both export lists (guard_core's 22 + fastapi-guard's 24) — no drift today, with the single-source-of-truth recommendation.
• Grouping opportunities (agent/cors/detection/otel prefixes) presented as an option with backward-compat trade-offs, explicitly not applied.

Safe wiring (non-breaking)

• ipinfo_token and ipinfo_db_path — long self-described as deprecated — now emit a runtime DeprecationWarning when explicitly set (a model_validator keyed on model_fields_set, so it fires once at construction, never on default or internal access). Both keep working; removal targeted for a future major.
• A targeted filterwarnings entry keeps existing fixtures quiet; dedicated tests assert the warning still fires.

The export single-source-of-truth is implemented on the fastapi-guard consumer side (its O3 PR derives __all__ from guard_core.__all__).

Verification

• check-sync: OK · ruff + ruff-format + mypy + vulture + xenon + deptry: clean · bandit: exit 0
• Full suite: 3704 passed, 100% line + branch coverage (0 missed), zero warnings

Part of the coordinated guard-core 3.2.0 release (with O1/O2, O4, O5, O6).