feat(hardening): login rate limiting, per-service memory limits, pinned images

- slowapi limiter on POST /auth/login (10/min per IP, Persian error msg);
  edge-level coarse limits stay in Traefik
- mem_limit on every main-compose service (~4.4GB worst case, protects the
  8GB shared host during rebuilds)
- monitoring images pinned to verified tags (prom v3.4.1, grafana 11.6.3,
  loki/promtail 3.5.0, node-exporter v1.9.1, postgres-exporter v0.17.1,
  cadvisor v0.49.1); exporter image name fixed to postgres-exporter

docker-compose.yml

@@ -29,6 +29,7 @@ services:
       retries: 10
 
     restart: unless-stopped
+    mem_limit: 1g
 
   # ==========================================================================
   # Traefik v3 — public reverse proxy (replaces nginx as the edge)
@@ -42,6 +43,7 @@ services:
     image: traefik:v3.6
     container_name: procurement-traefik
     restart: unless-stopped
+    mem_limit: 128m
     command:
       - --providers.docker=true
       - --providers.docker.exposedbydefault=false
@@ -103,6 +105,7 @@ services:
       - default
 
     restart: unless-stopped
+    mem_limit: 512m
 
   # MinIO Client (mc): waits for the server, creates the bucket, exits.
   # Use for ad-hoc ops too: docker compose run --rm minio-init ...
@@ -163,6 +166,7 @@ services:
       done
       "
     restart: unless-stopped
+    mem_limit: 256m
 
   # ==========================================================================
   # v2.6 — Casdoor (OIDC identity provider)
@@ -201,6 +205,7 @@ services:
       - default
 
     restart: unless-stopped
+    mem_limit: 768m
 
   api:
     build:
@@ -272,6 +277,7 @@ services:
         condition: service_completed_successfully
 
     restart: unless-stopped
+    mem_limit: 768m
 
   frontend:
     build:
@@ -300,6 +306,7 @@ services:
       - api
 
     restart: unless-stopped
+    mem_limit: 128m
 
 networks:
   # شبکه‌ی عمومی: فقط ترافیک و سرویس‌های عمومی. postgres روی شبکه‌ی