Plan 07 polish: release pipeline, security hardening, backup docs

[PianoNic]

Summary

• Release pipeline (.github/workflows/release.yml): semver tag → build+test → multi-arch Docker → ghcr.io → GitHub Release
• Limen.Contracts NuGet publish workflow on contracts/ changes to main
• Non-root Docker image (appuser in runtime stage)
• Rate limiting on login endpoints (10 req/min fixed window, 429 rejection)
• Security headers middleware (CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy)
• Rate limiter applied to /auth/login-password, /auth/magic-request, /auth/refresh
• Backup and restore documentation (docs/operations/backup-restore.md)
• README updated with backup section link

Closes #33