One short paragraph after the sponsorship note points companies building
multi-tenant APIs to Echo Pro, says it is a separate commercial library
that funds Echo's maintenance, and that Echo stays MIT.

v4 bug fixes end on 2026-12-31 as announced. Security-only fixes continue,
free and public, until 2027-12-31 for the latest v4 release; the plan
after 2027 will be published by 2027-06-30.

- SECURITY.md: version table with bug and security dates, what security
  fixes cover and how they ship, the IPExtractor configuration needed
  for two advisories, and that paid support buys no private fixes.
- README and ROADMAP: same dates, drop "LTS", and align the Go policy
  on the three most recent releases (matches CI).
- SUPPORT.md: paid support is Echo Support ($4,900/year, invoiced),
  replacing the GitHub Sponsors Support tier text.
- funding.json: v4 is a maintenance line, not long-term support.

* fix(router): decode parameters once and validate static path forms

Only unescape parameters when they were extracted from URL.RawPath.
Validate both decoded and escaped request paths before static filesystem
normalization so encoded empty segments cannot bypass route guards.

Preserve static prefixes and correctly percent-escaped filenames, and
document the existing router flag behavior without changing it.

Reports: GHSA-v97q-3xf5-rj74 (MyWorld319), GHSA-m7cf-rmhm-rf9m (alexreid)

* fix(static): reject empty wildcard boundaries after unescaping