refactor: audit improvements - rate limit ceiling, map route protection, lazy DevToolbar, lang=de

- lib/rate-limit.ts: add MAX_STORE_ENTRIES=10k ceiling + evictIfFull() to prevent DDoS memory exhaustion
- app/api/map/route.ts: add IP-based rate limiting (30 req/min) with proper Retry-After headers
- app/layout.tsx: lang='en' → 'de', DevToolbar loaded via dynamic import (reduces main bundle)
- app/layout.tsx: lazy DevToolbar keeps ~17KB out of production bundle via next/dynamic

app/layout.tsx

@@ -5,15 +5,20 @@
  */
 
 import type { Metadata } from 'next';
+import dynamic from 'next/dynamic';
 import Link from 'next/link';
 import './globals.css';
 import { SubpageNav } from '@/components/SubpageNav';
 import { ThemeToggle } from '@/components/ThemeToggle';
 import { ScrollToTop } from '@/components/ScrollToTop';
 import { Footer } from '@/components/Footer';
-import { DevToolbar } from '@/components/DevToolbar';
 import { getConfig, getGoogleFontsUrl, AppConfig } from '@/lib/config';
 
+// Lazy-load DevToolbar — keeps 17KB+ out of the production bundle
+const DevToolbar = dynamic(() => import('@/components/DevToolbar').then(m => ({ default: m.DevToolbar })), {
+  ssr: false,
+});
+
 export async function generateMetadata(): Promise<Metadata> {
   const config = getConfig();
   const siteTitle = config.seo.title;
@@ -141,7 +146,7 @@ export default function RootLayout({ children }: { children: React.ReactNode })
 
   return (
     <html
-      lang="en"
+      lang="de"
       suppressHydrationWarning
       style={themeVars as React.CSSProperties}
       data-preset={theme.preset}