Add rate limiting and request size limits

## Problem

The API has no rate limiting or request body size restrictions. This exposes it to:

- **Brute-force attacks** on `/user/signin` (OWASP A07: Identification and Authentication Failures)
- **DoS via large payloads** — a client can send arbitrarily large request bodies
- **Enumeration attacks** on user/group endpoints

## Expected Behavior

- Requests to sensitive endpoints (especially `/user/signin`) should be rate-limited per IP.
- Request body sizes should be capped at a reasonable limit.

## Suggested Fix

1. Add a rate-limiting middleware using a package like `golang.org/x/time/rate` or `github.com/ulule/limiter`.
2. Wrap the router handler with `http.MaxBytesReader` to cap request body size (e.g., 1MB).

## Affected Files
- `main.go`
- `controllers/middleware.go`