Fix aiomysql pool_pre_ping crash, add rate limiting and security hardening

Remove pool_pre_ping=True to fix startup crash caused by aiomysql 0.2.0
async adapter requiring a reconnect argument SQLAlchemy does not pass.
Add slowapi rate limiting, structured logging, CORS config, backend
health check, and nginx security headers.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/routers/public.py

@@ -1,24 +1,28 @@
-from fastapi import APIRouter, Depends
+from fastapi import APIRouter, Depends, Request
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy import select
+from sqlalchemy.orm import selectinload
 
 from app.dependencies import get_db
+from app.limiter import limiter
 from app.models.user import User
-from app.models.entry import Entry, EntryType
+from app.models.entry import EntryType
 from app.schemas.entry import PublicUserStats
 
 router = APIRouter(prefix="/api/public", tags=["public"])
 
 
 @router.get("/stats", response_model=list[PublicUserStats])
-async def public_stats(db: AsyncSession = Depends(get_db)):
-    users_result = await db.execute(select(User))
+@limiter.limit("30/minute")
+async def public_stats(request: Request, db: AsyncSession = Depends(get_db)):
+    users_result = await db.execute(
+        select(User).options(selectinload(User.entries))
+    )
     users = users_result.scalars().all()
 
     stats: list[PublicUserStats] = []
     for user in users:
-        entries_result = await db.execute(select(Entry).where(Entry.user_id == user.id))
-        entries = entries_result.scalars().all()
+        entries = user.entries
 
         adds = [e for e in entries if e.entry_type == EntryType.add]
         removes = [e for e in entries if e.entry_type == EntryType.remove]