docs: rank the destructive generator as item 0

It was written up in 4.7 but never made the work order, which is exactly how it
stayed dangerous in the first place.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

examples/inter-app-api-showcase/wrnexus.workspace.ts

@@ -0,0 +1,57 @@
+import type { WorkspaceConfig } from "@wrnexus/cli/workspace";
+
+// Map each app to the domains it serves. `wrnexus gateway` runs them all behind
+// one port and routes by Host header (add these hosts to your /etc/hosts).
+const config: WorkspaceConfig = {
+  defaultEnvironment: "development",
+  environments: {
+    development: {
+      protocol: "http",
+      rootDomain: "localhost",
+      port: 3000,
+      runtime: "development",
+      hmr: true,
+      build: false,
+      migrate: false,
+    },
+    staging: {
+      protocol: "https",
+      rootDomain: "staging.example.com",
+      port: 443,
+      runtime: "production",
+      hmr: false,
+      build: true,
+      migrate: true,
+    },
+    production: {
+      protocol: "https",
+      rootDomain: "example.com",
+      port: 443,
+      runtime: "production",
+      hmr: false,
+      build: true,
+      migrate: true,
+    },
+  },
+  // Gateway-wide security (all optional):
+  security: {
+    trustedHostsOnly: true, // reject requests for unknown domains
+    rateLimit: { max: 300, windowMs: 60_000 }, // per client IP
+    headers: true, // baseline security headers at the edge
+    accessLog: true, // log host → app, method, path, status
+  },
+  apps: [
+    { name: "web", dir: "apps/web", domains: ["localhost", "web.localhost"] },
+    {
+      name: "admin",
+      dir: "apps/admin",
+      domains: ["admin.localhost"],
+      // Lock the admin app down at the edge (pick one):
+      auth: { basic: { user: "admin", pass: "change-me" } },
+      // auth: { allowIps: ["127.0.0.1", "::1"] },
+      // auth: { forward: { url: "http://localhost:4001/api/verify" } }, // SSO
+    },
+  ],
+};
+
+export default config;