#1893 docs: the three things 0.1.42 changed that no page told

说明

## What it changes

Docs only, three pages, all of it about what 0.1.42 changed and no page said:

- **SECURITY.md** - the API-key endpoint list gains `/metrics/prometheus` (9545286). It answers the request totals and what is running, and the server gates it behind the same key check as `/metrics` (`serve/server.py:4753-4762`). The list is the place a reader checks what is protected, so it should be complete.
- **docs/DETAILS.md** - two gaps:
  - The Windows build's Visual Studio rule lived only as a comment in `setup.py`. Now in the "What the first start installs" paragraph: CUDA 13.0-13.2 take Visual Studio 2019/2022, 2026 only from CUDA 13.3 (#985); with no CUDA toolkit setup asks for no version at all, since the CPU image encoder is built by MSVC alone (#881, db5b1f1); `STRATA_VCVARS=<vcvars64.bat>` names an install `vswhere` cannot use.
  - The Monitor's request list gained the prompt's own speed (bafc8dd): fresh tokens (`prompt_tokens` minus `reused`) over `prompt_ms`, and no number when a prompt read no new token.
- **docs/TROUBLESHOOTING.md** - the same Windows case in bold for the user who sees `the Visual Studio C++ build tools were not found` (`setup.py:3300`), placed beside the Linux build-mismatch entry it mirrors, with the `STRATA_VCVARS` value and the fact that setup uses it only when the file exists.

## What it leaves alone

No code touched. Nothing that was right is reworded. The run config's key list, the Settings view's keys, the endpoints table and the model-settings paragraph were checked against the 0.1.42 tree and are accurate as they stand.

## How I checked

Every sentence read from source on the 0.1.42 tree: `serve/server.py:4753` (the gate), `setup.py:1390-1415` (`find_vcvars`, the range rule, `STRATA_VCVARS` at 1399-1402) and `setup.py:3300-3301` (the message and its hint), `serve/web/app.js:344-347` (the new column and its formula). `git grep -i STRATA_VCVARS upstream/main -- docs` found nothing before this change; the message string is quoted from the source.