fix: Security hardening and HA deployment guide

[ZPascal]

Summary

• Raised bcrypt cost factor from 10 to 12
• Fixed jsonError to use json.Marshal (prevents unescaped special characters in error responses)
• Fixed SQL injection pattern in NewTXTValuesInTransaction (parameterized query + prepared statement)
• Fixed goroutine leak in rate limiter: replaced time.Tick with time.NewTicker + stop() method
• Hardened CORS default: corsorigins now defaults to [] (deny all cross-origin) instead of ["*"]; extracted buildCORSOptions and added unit tests
• Added per-IP rate limiting on /register via register_ratelimit config option (default 10/min), documented in the README's Register endpoint and Configuration sections
• Added a High Availability Deployment section to the README (Prerequisites, DB/instance config, DNS load balancing, HTTP load balancing with Nginx and Apache2 examples, health checks, failure modes, upgrade procedure, security notes)

Test Plan

• go test -race ./... passes
• go build ./... builds cleanly
• POST /register from same IP beyond limit returns 429
• Different IPs are rate-limited independently
• corsorigins = [] blocks cross-origin requests by default