Security hardening: audit logs and rate limiting

[alanmaizon]

Problem

Security controls are minimal for broader deployment.

Outcome

Add audit logging and abuse protection controls.

Acceptance Criteria

• Structured audit events for key actions
• Request rate limiting for analysis path
• Security controls documented in SECURITY.md

Priority

Medium