Add production hardening: monitoring, backups, caching, and high-traffic resilience

- Recovery middleware (no more crash-on-panic), request metrics/monitoring
  store + admin API, in-memory TTL caching for read-heavy option/question/
  category lookups, gzip + rate-limiting middleware, sanitized chat message
  encoding, and pg_dump-based database backups with an admin API.
- Fix N+1 queries in the discover feed, candidate detail, and match list
  endpoints by batching selection/photo/user/last-message lookups into
  single queries instead of one-per-item loops.
- Tune DB connection pooling and add HTTP server timeouts + graceful
  shutdown so the API degrades gracefully instead of falling over under load.
- Fix a null (vs empty array) JSON response for candidates/matches without
  photos or interests, which crashed the web app's swipe card.

internal/config/config.go

@@ -20,6 +20,13 @@ type Config struct {
 	DBName     string
 	DBSSLMode  string
 
+	// تنظیمات connection pool؛ زیر بار بالا این‌ها از باز شدن بی‌رویه‌ی اتصال
+	// (که خود Postgres رو زمین می‌زنه) و از نشتی اتصالات راکد جلوگیری می‌کنن.
+	DBMaxOpenConns        int
+	DBMaxIdleConns        int
+	DBConnMaxLifetimeMins int
+	DBConnMaxIdleTimeMins int
+
 	JWTAccessSecret   string
 	JWTRefreshSecret  string
 	JWTAccessTTL      time.Duration
@@ -49,6 +56,11 @@ func Load() *Config {
 		DBName:     getEnv("DB_NAME", "dating_app"),
 		DBSSLMode:  getEnv("DB_SSLMODE", "disable"),
 
+		DBMaxOpenConns:        getEnvInt("DB_MAX_OPEN_CONNS", 25),
+		DBMaxIdleConns:        getEnvInt("DB_MAX_IDLE_CONNS", 10),
+		DBConnMaxLifetimeMins: getEnvInt("DB_CONN_MAX_LIFETIME_MINUTES", 30),
+		DBConnMaxIdleTimeMins: getEnvInt("DB_CONN_MAX_IDLE_TIME_MINUTES", 5),
+
 		JWTAccessSecret:  getEnv("JWT_ACCESS_SECRET", "change-me-access-secret"),
 		JWTRefreshSecret: getEnv("JWT_REFRESH_SECRET", "change-me-refresh-secret"),
 		JWTAccessTTL:     time.Duration(getEnvInt("JWT_ACCESS_TTL_MINUTES", 60*24)) * time.Minute,