Phase 9: Admin & DevOps — health check, rate limiting, logging, site admin, Docker healthcheck

- Health check endpoint (GET /api/health) with DB probe and uptime
- In-memory sliding window rate limiting on login (10/60s) and register (5/3600s)
- Structured logging with pino (request timing in hooks, Socket.IO events in server.js)
- Site admin dashboard with tenant stats, CRUD, and requireSiteAdmin guard
- Tenant admin enhanced with tag and category management UI
- Docker HEALTHCHECK in Dockerfile and docker-compose.yml
- Backup documentation (docs/backup.md)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/hooks.server.ts

@@ -1,8 +1,10 @@
 import type { Handle } from '@sveltejs/kit';
 import { resolveTenant } from '$lib/server/tenant.js';
 import { validateSession, sessionCookieName } from '$lib/server/auth.js';
+import { logger } from '$lib/server/logger.js';
 
 export const handle: Handle = async ({ event, resolve }) => {
+	const start = Date.now();
 	// 1. Resolve tenant from hostname
 	const hostname = event.url.hostname;
 	const tenant = await resolveTenant(hostname);
@@ -45,5 +47,14 @@ export const handle: Handle = async ({ event, resolve }) => {
 	// 3. Read theme preference
 	event.locals.theme = event.cookies.get('theme') || undefined;
 
-	return resolve(event);
+	const response = await resolve(event);
+
+	logger.info({
+		method: event.request.method,
+		path: event.url.pathname,
+		status: response.status,
+		duration_ms: Date.now() - start
+	}, 'request');
+
+	return response;
 };