docs: the ASVS chapter roll-up says 13 but lists 14 (#116)

§A.3's roll-up reads "In scope: 14 chapters active today (V1–V8, V11–V16)"
— it said 13. V1–V8 is 8 and V11–V16 is 6.

The table directly above it is the authority and agrees with 14: exactly 14
rows carry an in-scope "Yes" (V1–V8, V11–V16), V17 is the sole "No", and V9
and V10 carry their own qualified verdicts.

This is the same off-by-one that was already in the line before #111 — it
read "12 chapters active (V1, V2, V4–V8, V11–V16)", which is 13. #111
correctly brought V3 into scope but carried the arithmetic error forward
rather than recomputing it, so the count moved 12→13 when the list moved
13→14.

Found because the website mirrors this file as
`docs/secure-development-standards.md` and publishes it as
`assets/MessageFoundry-Secure-Development-Standards.pdf`. That copy was
corrected to 14 in website PR #105, so the two have been disagreeing since
#111 merged. This makes them agree, with the engine as the correct one.

The "17 chapters" statements at :243 and :248 are right and untouched — that
is the total in ASVS 5.0, not the in-scope count.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: wshallwshall

docs/Secure_Development_Standards.md

@@ -391,7 +391,7 @@ MessageFoundry (MEFOR) is an open-source **HL7 v2.x integration engine** — a c
 | V16 | Security Logging and Error Handling | Yes | Tamper-resistant audit log; fail-closed errors; no PHI/secrets in logs |
 | V17 | WebRTC | **No** | Not applicable — no WebRTC; documented exclusion |
 
-*In scope: 13 chapters active today (V1–V8, V11–V16). V10 (OAuth/OIDC) is now **partly active** — outbound OAuth 2.0 client-credentials / SMART on FHIR are built (ADR 0024); inbound OAuth/OIDC remains N/A. V9 (JWT) is in scope when JWT is introduced — currently N/A. Documented exclusion: V17.*
+*In scope: 14 chapters active today (V1–V8, V11–V16). V10 (OAuth/OIDC) is now **partly active** — outbound OAuth 2.0 client-credentials / SMART on FHIR are built (ADR 0024); inbound OAuth/OIDC remains N/A. V9 (JWT) is in scope when JWT is introduced — currently N/A. Documented exclusion: V17.*
 
 ### A.4 Interface authentication mechanisms