feat: add CORS and rate limiting middleware

CORS:
- Configurable allowed origins (wildcard "*" or specific domains)
- Handles OPTIONS preflight with configurable methods, headers, max-age
- Exposed headers support for browser API access
- Env override: CORS_ALLOWED_ORIGINS

Rate Limiting:
- In-memory per-IP sliding window counter
- Configurable request limit and time window
- Background goroutine cleans up stale IP entries
- HTTP 429 with Retry-After header when exceeded
- Extracts real IP from X-Forwarded-For and X-Real-IP (proxy-aware)
- Env overrides: RATE_LIMIT_REQUESTS, RATE_LIMIT_WINDOW, RATE_LIMIT_CLEANUP_INTERVAL
- Set requests=0 in config to disable

Both wired into main.go as middleware chain: rate_limit → cors → handler.
Config example updated with [cors] and [rate_limit] sections.
Full test coverage for both middleware packages.

cmd/searxng-go/main.go

@@ -11,6 +11,7 @@ import (
 	"github.com/ashie/gosearch/internal/cache"
 	"github.com/ashie/gosearch/internal/config"
 	"github.com/ashie/gosearch/internal/httpapi"
+	"github.com/ashie/gosearch/internal/middleware"
 	"github.com/ashie/gosearch/internal/search"
 )
 
@@ -61,7 +62,26 @@ func main() {
 	mux.HandleFunc("/healthz", h.Healthz)
 	mux.HandleFunc("/search", h.Search)
 
+	// Apply middleware: rate limiter → CORS → handler.
+	var handler http.Handler = mux
+	handler = middleware.CORS(middleware.CORSConfig{
+		AllowedOrigins: cfg.CORS.AllowedOrigins,
+		AllowedMethods: cfg.CORS.AllowedMethods,
+		AllowedHeaders: cfg.CORS.AllowedHeaders,
+		ExposedHeaders: cfg.CORS.ExposedHeaders,
+		MaxAge:         cfg.CORS.MaxAge,
+	})(handler)
+	handler = middleware.RateLimit(middleware.RateLimitConfig{
+		Requests:        cfg.RateLimit.Requests,
+		Window:          cfg.RateLimitWindow(),
+		CleanupInterval: cfg.RateLimitCleanupInterval(),
+	}, logger)(handler)
+
 	addr := fmt.Sprintf(":%d", cfg.Server.Port)
-	logger.Info("searxng-go starting", "addr", addr, "cache", searchCache.Enabled())
-	log.Fatal(http.ListenAndServe(addr, mux))
+	logger.Info("searxng-go starting",
+		"addr", addr,
+		"cache", searchCache.Enabled(),
+		"rate_limit", cfg.RateLimit.Requests > 0,
+	)
+	log.Fatal(http.ListenAndServe(addr, handler))
 }