🔧(ops) production readiness: rate limiting, limits, pinned images #185

Production readiness gaps

Found during a code audit; can be split into separate tasks:

• No rate limiting on any endpoint (DRF throttling isn't configured), including the token-authenticated indexing endpoint.
• No request size limits specific to bulk indexing (number of documents per request, content length).
• Helm: backend.resources: {}. No requests or limits are set by default.
• compose: opensearchproject/opensearch:latest and opensearch-dashboards:latest aren't pinned, so dev may drift from the version used in production. redis:5 is end-of-life.
• Error handling: OpenSearch errors (TransportError, timeouts) aren't caught in the views and surface as 500s (e.g. the order_by=title bug). The client timeout is hard-coded to 50s.
• Observability: logs only (see Add Prometheus metrics endpoint #119 for metrics). No request or OpenSearch latency metrics.