Security: add rate limiting, input validation, and filter category

validation
Backend:
- Add rate limiting middleware (mw/ratelimit.go) - in-memory per-IP
  limiter
- Apply rate limits per endpoint group:
  - Public read-only: 120/min
  - Registration: 10/min
  - Portfolio filters: 60/min
  - Authenticated users: 120/min
  - Admin: none (trusted)
- Add 256 char input length validation on portfolio endpoints
- Validate filter categories exist in DB before querying
- Secure GetImage endpoint: only allow UUID or numeric timestamp (15-20
  digits)
- Remove pattern-based image lookup to prevent enumeration
- Add services validation: name (100), duration (1-480), patch test
  (0-168)
  Frontend:
- Add maxlength=256 to portfolio tag/search inputs
- Add maxlength to registration: name (50), email (255), phone (20),
  password (72)
- Add maxlength=100 to service name input

README.md

@@ -264,6 +264,24 @@ grep -n "r\.\(Get\|Post\|Put\|Delete\|Patch\)" backend/main.go
 ```
 
 **Middleware Chain:**
+- RequestID, RealIP, Logger, Recoverer, Timeout(15s)
+- Security headers (X-Content-Type-Options, X-Frame-Options, X-XSS-Protection)
+- Rate limiting (per-endpoint):
+  - Public read-only: 120/min
+  - Registration: 10/min
+  - Portfolio filters: 60/min
+  - Portfolio single image: 120/min
+  - Portfolio admin: 60/min
+  - Authenticated users: 120/min
+  - Admin search: 60/min
+  - Admin-only routes: none (trusted)
+
+**Input Validation:**
+- Backend validates all inputs against DB schema constraints
+- Frontend adds maxlength attributes matching DB limits
+- Registration: name (1-50), email (255), phone (20), password (72)
+- Services: name (100), price (>0), duration (1-480), patch test (0-168), age (0-100)
+- Portfolio: tags/filters (256 char max)
 ```bash
 grep -n "r\.Use\|r\.Group" backend/main.go
 ```