feat(hardening): login rate limiting, per-service memory limits, pinned images

- slowapi limiter on POST /auth/login (10/min per IP, Persian error msg);
  edge-level coarse limits stay in Traefik
- mem_limit on every main-compose service (~4.4GB worst case, protects the
  8GB shared host during rebuilds)
- monitoring images pinned to verified tags (prom v3.4.1, grafana 11.6.3,
  loki/promtail 3.5.0, node-exporter v1.9.1, postgres-exporter v0.17.1,
  cadvisor v0.49.1); exporter image name fixed to postgres-exporter

monitoring/docker-compose.monitoring.yml

@@ -19,7 +19,7 @@
 services:
   # ---------------------------------------------------------------- errors --
   glitchtip:
-    image: glitchtip/glitchtip:latest
+    image: glitchtip/glitchtip:latest  # pinned upstream: version tags are dated, keep an eye on updates
     container_name: monitoring-glitchtip
     mem_limit: 640m
     environment:
@@ -70,7 +70,7 @@ services:
 
   # --------------------------------------------------------------- metrics --
   prometheus:
-    image: prom/prometheus:latest
+    image: prom/prometheus:v3.4.1
     container_name: monitoring-prometheus
     mem_limit: 512m
     command:
@@ -85,7 +85,7 @@ services:
     restart: unless-stopped
 
   grafana:
-    image: grafana/grafana:latest
+    image: grafana/grafana:11.6.3
     container_name: monitoring-grafana
     mem_limit: 256m
     environment:
@@ -105,7 +105,7 @@ services:
 
   # ------------------------------------------------------------------ logs --
   loki:
-    image: grafana/loki:latest
+    image: grafana/loki:3.5.0
     container_name: monitoring-loki
     mem_limit: 384m
     command: -config.file=/etc/loki/loki-config.yml
@@ -117,7 +117,7 @@ services:
     restart: unless-stopped
 
   promtail:
-    image: grafana/promtail:latest
+    image: grafana/promtail:3.5.0
     container_name: monitoring-promtail
     mem_limit: 64m
     command: -config.file=/etc/promtail/promtail-config.yml
@@ -131,7 +131,7 @@ services:
 
   # -------------------------------------------------------------- exporters --
   node-exporter:
-    image: prom/node-exporter:latest
+    image: prom/node-exporter:v1.9.1
     container_name: monitoring-node-exporter
     mem_limit: 32m
     command:
@@ -144,7 +144,7 @@ services:
     restart: unless-stopped
 
   postgres-exporter:
-    image: prometheuscommunity/postgres-postgres-exporter:latest
+    image: prometheuscommunity/postgres-exporter:v0.17.1
     container_name: monitoring-postgres-exporter
     mem_limit: 48m
     environment:
@@ -156,7 +156,7 @@ services:
     restart: unless-stopped
 
   cadvisor:
-    image: gcr.io/cadvisor/cadvisor:latest
+    image: gcr.io/cadvisor/cadvisor:v0.49.1
     container_name: monitoring-cadvisor
     mem_limit: 128m
     privileged: true