Fix aiomysql pool_pre_ping crash, add rate limiting and security hardening

Remove pool_pre_ping=True to fix startup crash caused by aiomysql 0.2.0
async adapter requiring a reconnect argument SQLAlchemy does not pass.
Add slowapi rate limiting, structured logging, CORS config, backend
health check, and nginx security headers.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/routers/auth.py

@@ -1,17 +1,22 @@
-from fastapi import APIRouter, Depends, HTTPException, status
+import logging
+
+from fastapi import APIRouter, Depends, HTTPException, Request, status
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy import select
 
 from app.dependencies import get_db
+from app.limiter import limiter
 from app.models.user import User
 from app.schemas.user import UserCreate, Token, LoginRequest
 from app.utils.security import hash_password, verify_password, create_token
 
+logger = logging.getLogger("bourbonacci.auth")
 router = APIRouter(prefix="/api/auth", tags=["auth"])
 
 
 @router.post("/register", response_model=Token, status_code=status.HTTP_201_CREATED)
-async def register(body: UserCreate, db: AsyncSession = Depends(get_db)):
+@limiter.limit("5/minute")
+async def register(request: Request, body: UserCreate, db: AsyncSession = Depends(get_db)):
     result = await db.execute(select(User).where(User.email == body.email))
     if result.scalar_one_or_none():
         raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="Email already registered")
@@ -25,15 +30,19 @@ async def register(body: UserCreate, db: AsyncSession = Depends(get_db)):
     await db.commit()
     await db.refresh(user)
 
+    logger.info("New user registered: %s", body.email)
     return Token(access_token=create_token(user.id))
 
 
 @router.post("/login", response_model=Token)
-async def login(body: LoginRequest, db: AsyncSession = Depends(get_db)):
+@limiter.limit("10/minute")
+async def login(request: Request, body: LoginRequest, db: AsyncSession = Depends(get_db)):
     result = await db.execute(select(User).where(User.email == body.email))
     user = result.scalar_one_or_none()
 
     if not user or not verify_password(body.password, user.password_hash):
+        logger.warning("Failed login for: %s", body.email)
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid credentials")
 
+    logger.info("Login: %s (id=%s)", body.email, user.id)
     return Token(access_token=create_token(user.id))

backend/app/routers/public.py

@@ -1,24 +1,28 @@
-from fastapi import APIRouter, Depends
+from fastapi import APIRouter, Depends, Request
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy import select
+from sqlalchemy.orm import selectinload
 
 from app.dependencies import get_db
+from app.limiter import limiter
 from app.models.user import User
-from app.models.entry import Entry, EntryType
+from app.models.entry import EntryType
 from app.schemas.entry import PublicUserStats
 
 router = APIRouter(prefix="/api/public", tags=["public"])
 
 
 @router.get("/stats", response_model=list[PublicUserStats])
-async def public_stats(db: AsyncSession = Depends(get_db)):
-    users_result = await db.execute(select(User))
+@limiter.limit("30/minute")
+async def public_stats(request: Request, db: AsyncSession = Depends(get_db)):
+    users_result = await db.execute(
+        select(User).options(selectinload(User.entries))
+    )
     users = users_result.scalars().all()
 
     stats: list[PublicUserStats] = []
     for user in users:
-        entries_result = await db.execute(select(Entry).where(Entry.user_id == user.id))
-        entries = entries_result.scalars().all()
+        entries = user.entries
 
         adds = [e for e in entries if e.entry_type == EntryType.add]
         removes = [e for e in entries if e.entry_type == EntryType.remove]