Harden credentials and authentication security

[Cangerana]

Summury

• Remove tracked database credentials and add safe example env/database config files
• Harden production SSL, host allowlisting, JWT secret handling, and production DB credential requirements
• Add Rack::Attack throttling for login/register endpoints with focused request specs
• Document required production environment variables in the README

Verification

• `git diff --check main...HEAD`
• `bundle exec rubocop Gemfile app/services/auth/json_web_token.rb config/initializers/rack_attack.rb spec/support/rack_attack.rb spec/requests/api/v1/auth/sessions_spec.rb spec/requests/api/v1/auth/registrations_spec.rb spec/services/auth/json_web_token_spec.rb`
• `bundle exec brakeman --no-pager`
• `bundle exec bundler-audit --config config/bundler-audit.yml`
• `bundle exec rails middleware | rg "Rack::Attack"`
• `docker compose run --rm -e RAILS_ENV=test web bundle exec rspec spec/requests/api/v1/auth/sessions_spec.rb spec/requests/api/v1/auth/registrations_spec.rb spec/services/auth/json_web_token_spec.rb`

Notes

• Full suite still has unrelated existing failures in the user role enum spec and Stripe env setup specs.
• If previously committed DB credentials were pushed/shared, rotate those passwords even after this PR merges."