chore: save iqon static deploy snapshot

reports/phase1-baseline-2026-05-20.md

@@ -0,0 +1,54 @@
+# IQON Phase 1 Baseline
+
+Purpose: зафиксировать состояние live `iqon.com` перед применением локального Phase 1 hardening-пакета.
+
+## Contents
+
+- [Command](#command)
+- [Result](#result)
+- [Failing Checks](#failing-checks)
+- [Passing Checks](#passing-checks)
+- [Interpretation](#interpretation)
+
+## Command
+
+```bash
+scripts/iqon-phase1-verify.sh https://iqon.com
+```
+
+Run date: 20 May 2026.
+
+## Result
+
+Overall status: failed, as expected before snippet and hosting rules are activated.
+
+## Failing Checks
+
+| Check | Observed Signal |
+|-------|-----------------|
+| `X-Content-Type-Options` | Missing |
+| `X-Frame-Options` | Missing |
+| `Referrer-Policy` | Missing |
+| `Permissions-Policy` | Missing |
+| `Content-Security-Policy` | Missing |
+| Viewport meta | Missing |
+| Skip link | Missing |
+| Known HTTP URLs | Still present |
+| `og:site_name` | Still has `- IQON` |
+| REST users endpoint | Public users still exposed |
+| `readme.html` | Returns `200` |
+
+## Passing Checks
+
+| Check | Observed Signal |
+|-------|-----------------|
+| XML-RPC HEAD smoke | Empty reply via HEAD, status `000` |
+
+## Interpretation
+
+The baseline confirms that the Phase 1 package targets real current live findings. After activation, the same script should move from failed to passed, except any item that is intentionally handled outside WordPress, such as physical install-document files.
+
+---
+
+*Created: 20 May 2026*
+*Updated: 20 May 2026*