feat(hardening): login rate limiting, per-service memory limits, pinned images

- slowapi limiter on POST /auth/login (10/min per IP, Persian error msg);
  edge-level coarse limits stay in Traefik
- mem_limit on every main-compose service (~4.4GB worst case, protects the
  8GB shared host during rebuilds)
- monitoring images pinned to verified tags (prom v3.4.1, grafana 11.6.3,
  loki/promtail 3.5.0, node-exporter v1.9.1, postgres-exporter v0.17.1,
  cadvisor v0.49.1); exporter image name fixed to postgres-exporter

backend/app/main.py

@@ -16,6 +16,8 @@ from fastapi.exceptions import RequestValidationError
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import JSONResponse
 from prometheus_fastapi_instrumentator import Instrumentator
+from slowapi import _rate_limit_exceeded_handler
+from slowapi.errors import RateLimitExceeded
 from sqlalchemy import text as sql_text
 from sqlalchemy.exc import IntegrityError
 
@@ -34,6 +36,7 @@ from app.observability import RequestContextMiddleware, setup_logging
 from app.routers import ROUTERS
 from app.services.quote_service import auto_expire_quotes
 from app.utils.errors import AppError
+from app.utils.ratelimit import limiter
 
 setup_logging(settings.LOG_FORMAT)
 logger = logging.getLogger("procurement")
@@ -131,6 +134,10 @@ app.add_middleware(
 )
 app.add_middleware(RequestContextMiddleware)
 
+# Rate limiting — login brute-force brake (edge rate limit lives in Traefik).
+app.state.limiter = limiter
+app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)
+
 # Prometheus /metrics (requests, latency, errors) — mounted at app level,
 # outside the authenticated /api/v1 prefix; scrape target for the
 # monitoring stack.