Security Baseline — security headers, CORS, baseline rate limiter

**Technology:** Echo security-headers middleware, CORS config, baseline rate limiter

Security headers middleware, CORS configuration, and an in-process rate-limiting baseline applied to every generated project regardless of which feature packs were selected.

Distinct from Feature Pack D's distributed/Redis-backed limiter — see `README.md`.

**Priority:** 5th in the Core Foundations order — production readiness, sequenced last since it hardens what the rest of the list builds.

Start with README.md, especially the distinction from Feature Pack D's distributed/Redis-backed limiter, and locate the generator paths that apply core foundations. Done means every generated project receives security headers, CORS configuration, and an in-process baseline rate limiter regardless of selected feature packs.

Written by the indexing model from the issue text.