Security: add rate limiting, input validation, and filter category

validation
Backend:
- Add rate limiting middleware (mw/ratelimit.go) - in-memory per-IP
  limiter
- Apply rate limits per endpoint group:
  - Public read-only: 120/min
  - Registration: 10/min
  - Portfolio filters: 60/min
  - Authenticated users: 120/min
  - Admin: none (trusted)
- Add 256 char input length validation on portfolio endpoints
- Validate filter categories exist in DB before querying
- Secure GetImage endpoint: only allow UUID or numeric timestamp (15-20
  digits)
- Remove pattern-based image lookup to prevent enumeration
- Add services validation: name (100), duration (1-480), patch test
  (0-168)
  Frontend:
- Add maxlength=256 to portfolio tag/search inputs
- Add maxlength to registration: name (50), email (255), phone (20),
  password (72)
- Add maxlength=100 to service name input

frontend/src/lib/components/admin/ImageUpload.svelte

@@ -469,6 +469,7 @@
 
 					<input
 						type="search"
+						maxlength={256}
 						enterkeyhint="done"
 						autocomplete="off"
 						autocorrect="off"

frontend/src/lib/components/admin/ServicesManagement.svelte

@@ -551,6 +551,7 @@
 				<Input
 					id="service-name"
 					type="text"
+					maxlength={100}
 					placeholder="e.g., Haircut, Color, Blowdry"
 					bind:value={newService.name}
 					onblur={validateNameField}