docs: "Risk that remains" renders inside the last bullet in T7 and T28 #83

In THREAT-MODEL.md, the line "Risk that remains: …" comes right after the last bullet of "What to do:" in T7 (line 245) and T28 (line 648), with no blank line between them. Markdown then treats it as a continuation of that bullet, so it renders as part of the last piece of advice, not as its own paragraph. The security review of #82 found this; the new T32 there gets the blank line.

Done when

• T7 and T28 have a blank line before "Risk that remains:".
• No other threat in THREAT-MODEL.md has a "Risk that remains:" line right after a list line.