security: No API rate limiting

[nfebe]

Problem

No rate limiting middleware exists on any API endpoint. Endpoints like /deployments/:name/logs, backup operations, and authentication can be called without throttling.

Impact

• Denial of service via resource exhaustion
• Brute-force attacks on authentication endpoints
• Abuse of expensive operations (backups, container creation)

Proposed Fix

Add rate limiting middleware using golang.org/x/time/rate or a Gin rate-limit plugin:

• Auth endpoints: 10 req/min per IP
• Deployment operations: 30 req/min per API key
• Log streaming: 5 concurrent connections per API key
• Backup operations: 2 concurrent per API key