security: implement pentest remediation (PROXY-001, BURN-001, RATE-001)

PROXY-001: Add startup warning when TRUSTED_PROXY_SECRET empty in production
- validate_security_config() checks for missing proxy secret
- Additional warning when PKI enabled without proxy secret
- Tests for security configuration validation

BURN-001: HEAD requests now trigger burn-after-read deletion
- Prevents attacker from probing paste existence before retrieval
- Updated test to verify new behavior

RATE-001: Add RATE_LIMIT_MAX_ENTRIES to cap memory usage
- Default 10000 unique IPs tracked
- Prunes oldest entries when limit exceeded
- Protects against memory exhaustion DoS

Test count: 284 -> 291 (7 new security tests)

documentation/deployment.md

@@ -293,6 +293,7 @@ See `examples/flaskpaste.env` for a complete template.
 | `FLASKPASTE_RATE_LIMIT` | `1` | Enable IP-based rate limiting |
 | `FLASKPASTE_RATE_MAX` | `10` | Max requests per window (anon) |
 | `FLASKPASTE_RATE_AUTH_MULT` | `5` | Multiplier for authenticated users |
+| `FLASKPASTE_RATE_MAX_ENTRIES` | `10000` | Max tracked IPs (memory DoS protection) |
 | `FLASKPASTE_ANTIFLOOD` | `1` | Enable dynamic PoW under attack |
 | `FLASKPASTE_PKI_ENABLED` | `0` | Enable built-in PKI |