Security: add rate limiting, input validation, and filter category

validation
Backend:
- Add rate limiting middleware (mw/ratelimit.go) - in-memory per-IP
  limiter
- Apply rate limits per endpoint group:
  - Public read-only: 120/min
  - Registration: 10/min
  - Portfolio filters: 60/min
  - Authenticated users: 120/min
  - Admin: none (trusted)
- Add 256 char input length validation on portfolio endpoints
- Validate filter categories exist in DB before querying
- Secure GetImage endpoint: only allow UUID or numeric timestamp (15-20
  digits)
- Remove pattern-based image lookup to prevent enumeration
- Add services validation: name (100), duration (1-480), patch test
  (0-168)
  Frontend:
- Add maxlength=256 to portfolio tag/search inputs
- Add maxlength to registration: name (50), email (255), phone (20),
  password (72)
- Add maxlength=100 to service name input

backend/handlers/services/services.go

@@ -87,12 +87,20 @@ func CreateServiceHandler(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "Name is required", http.StatusBadRequest)
 		return
 	}
+	if len(req.Name) > 100 {
+		http.Error(w, "Name must be 100 characters or less", http.StatusBadRequest)
+		return
+	}
 	if req.Price <= 0 {
 		http.Error(w, "Price must be greater than 0", http.StatusBadRequest)
 		return
 	}
-	if req.PatchTestDurationHours < 0 {
-		http.Error(w, "Patch test duration cannot be negative", http.StatusBadRequest)
+	if req.DurationMinutes <= 0 || req.DurationMinutes > 480 {
+		http.Error(w, "Duration must be between 1 and 480 minutes", http.StatusBadRequest)
+		return
+	}
+	if req.PatchTestDurationHours < 0 || req.PatchTestDurationHours > 168 {
+		http.Error(w, "Patch test duration must be between 0 and 168 hours", http.StatusBadRequest)
 		return
 	}
 	if req.MinimumAgeRequired < 0 || req.MinimumAgeRequired > 100 {