Add documentation on things to do before going into production

- [ ] Note that disabling GraphiQL does NOT prevent people from inspecting your schema/documentation/etc - they can just run it themselves
- [ ] Beware various security issues, break down by types of auth: JWT, cookies, etc
- [ ] Prevent DOS attacks - analyse incoming requests for complexity and only allow through if simple enough; require limits for all collections; etc etc. Simplest workaround is to just whitelist the queries you're using
- [ ] Ensure logging isn't too much!
- [ ] Ensure Row Level Security is enabled on every table

More to come

Review the repository's existing production and deployment documentation first; no specific file or entry point is named in the issue. Turn the checklist into a structured guide covering GraphiQL visibility, authentication-specific security, request complexity and collection limits, logging, and PostgreSQL row-level security, with each recommendation clearly actionable.

Written by the indexing model from the issue text.