docs: production hardening — rate limiting and request inspection

[rennf93]

Value this change must deliver

This template is the starting point for many production applications, but its docs currently say nothing about application-layer request protections: backend/app/main.py ships only CORS middleware, with no rate limiting, payload inspection, or bot/probe filtering. This PR adds a docs-only "Production Hardening" section to the README stating what the template does not include, listing established options with their tradeoffs, and showing one compact wiring example built around a log-first rollout. Zero code paths are touched. It implements the docs-first option discussed in #2486; the placement is trivially movable if maintainers prefer another file.

Disclosure: I maintain fastapi-guard, one of the options listed in the new section; the section itself is neutral and lists alternatives with tradeoffs.

What this changes

• README.md — new ## Production Hardening section (30 lines) between ## Deployment and ## Development:
  • Intro stating what the template deliberately omits, and why edge/proxy controls complement rather than replace app-layer middleware.
  • Neutral bullet list of three established options with one differentiator each: slowapi (minimal, per-route limits), fastapi-limiter (Redis-backed), fastapi-guard (broader 17-check pipeline; passive log-only mode).
  • One 11-line example wiring fastapi-guard into backend/app/main.py in passive mode — start log-only, flip passive_mode=False to enforce.
  • A closing honesty paragraph: app-layer middleware does not cover authn/authz, IDOR/business-logic flaws, or volumetric DDoS.

What this deliberately does not change

• No backend/, frontend/, or compose file changes.
• No new dependencies; the libraries are listed as documentation, not installed.
• Template behavior is identical — the diff is 30 added doc lines in one file.

How to test

• Review the markdown rendering of the new section (all relative links verified to exist in-repo).
• git diff origin/master --stat shows exactly one file changed:

 README.md | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

[YuriiMotov]

Thanks for your interest and efforts!

We ask people to only open PRs when it's explicitly requested by maintainers.
See https://tiangolo.com/open-source/contributing/ and PR description template:

Please start with a GitHub Discussion.

Once a team member asks you to open a PR, create it and link the discussion here.

I will close this for now to keep things clean.
Thanks for understanding!