Security:
- Add slowapi dependency for rate limiting
- Create rate_limit.py module with configurable limits
- Apply 5 requests/minute limit to login endpoint
- Make rate limit configurable via ORCHARD_LOGIN_RATE_LIMIT env var
Testing:
- Set high rate limit (1000/min) in docker-compose.local.yml for tests
- All 265 tests pass
