chore: production readiness audit

- Move plans/ to dev-docs/, delete unused scaffold SVGs
- Create .dockerignore, rename container to immich-folio
- Extract BackLink component and toPhotoItems() helper in page.tsx
- Add keyboard accessibility (role=button, tabIndex, onKeyDown) to PhotoGrid
- Add aria-label to Lightbox EXIF toggle
- Fix React lint: replace setState-in-effect with useState initializer
- Add rate limiting to /api/auth (brute-force protection, 10 RPM)
- Add HSTS and X-DNS-Prefetch-Control security headers
- Add Secure flag to auth cookie in production
- New unit tests: rate-limit.test.ts (5), auth.test.ts (12)
- All 47 tests pass, 0 lint errors, build clean

app/api/auth/route.ts

@@ -5,8 +5,20 @@
 
 import { NextRequest, NextResponse } from 'next/server';
 import { authenticate, isProtected } from '@/lib/auth';
+import { checkRateLimit } from '@/lib/rate-limit';
+
+/** Tight limit for auth attempts — 10 per minute per IP. */
+const AUTH_RPM = 10;
 
 export async function POST(request: NextRequest) {
+  // ── Rate limiting (brute-force protection) ──────────
+  const ip = request.headers.get('x-forwarded-for')?.split(',')[0].trim() || 'unknown';
+  const { success } = checkRateLimit(`auth:${ip}`, AUTH_RPM);
+
+  if (!success) {
+    return NextResponse.json({ error: 'Too many attempts, try again later' }, { status: 429 });
+  }
+
   try {
     const body = await request.json();
     const { slug, password } = body;