chore(backend) : rate limiting, cache-control, remove twig, clean deps

- Add login_throttling on /login_check (5 attempts/min) with symfony/rate-limiter
- Add Cache-Control: public, max-age=86400 on avatar responses
- Remove symfony/twig-bundle (unused in API-only project)
- Remove unused dev deps: symfony/browser-kit, symfony/css-selector
- Rename API Platform title to "Lesstime API"

Tickets: T-010, T-016, T-022, T-024, T-025

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/Controller/UserAvatarController.php

@@ -91,7 +91,7 @@ class UserAvatarController extends AbstractController
         $extension = pathinfo($user->getAvatarFileName(), PATHINFO_EXTENSION);
         $mimeMap   = ['jpg' => 'image/jpeg', 'jpeg' => 'image/jpeg', 'png' => 'image/png', 'webp' => 'image/webp', 'gif' => 'image/gif'];
         $response->headers->set('Content-Type', $mimeMap[$extension] ?? 'application/octet-stream');
-        $response->headers->set('Cache-Control', 'no-cache, must-revalidate');
+        $response->headers->set('Cache-Control', 'public, max-age=86400');
 
         return $response;
     }