add rate limiting and HSTS for security hardening

- Add Hammer library for rate limiting with ETS backend
- Rate limit login (5/min), magic link (3/min), newsletter (10/min), API (60/min)
- Add themed 429 error page using bare shop styling
- Enable HSTS in production with rewrite_on for Fly proxy
- Add security hardening plan to docs

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

lib/berrypod_web/controllers/cart_controller.ex

@@ -11,6 +11,8 @@ defmodule BerrypodWeb.CartController do
 
   alias Berrypod.Cart
 
+  plug BerrypodWeb.Plugs.RateLimit, [type: :api] when action == :update
+
   @doc """
   Updates the cart in session (JSON API for JS hook).
   """