security: Add rate limiting, input validation, and tenant isolation on all handlers

- Add rate limiting per endpoint (login: 5/min, API: 100/min)
- Add input validation helpers (email, UUID, string, int)
- Add tenant isolation to all handlers
- Remove old validation.go, replace with input.go
- Fix service/customer.go to use new validation functions
- Build successful

backend/main.go

@@ -156,6 +156,9 @@ func main() {
 	
 	prometheus.MustRegister(requestDuration, requestCount, activeUsers)
 
+	// Rate limiter
+	rateLimiter := middleware.NewRateLimiter()
+
 	r := chi.NewRouter()
 	r.Use(middleware.SecurityHeaders)
 	r.Use(middleware.CORS)
@@ -163,6 +166,7 @@ func main() {
 	r.Use(hlog.RequestIDHandler("req_id", "X-Request-ID"))
 	r.Use(middleware.Logger(logger))
 	r.Use(chimw.Recoverer)
+	r.Use(middleware.RateLimit(rateLimiter))
 	// Metrics middleware
 	r.Use(func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {