fix: address independent review findings

docs/PRODUCTION_PROFILE.md

@@ -13,7 +13,9 @@ hardening work package.
 2. Replace `StaticTokenAuthProvider` with validated OIDC/JWT or mTLS workload
    identity. Bind issuer, audience, subject, expiry, and revocation policy.
 3. Put the service behind TLS and authenticated ingress. Do not trust arbitrary
-   forwarded identity headers.
+   forwarded identity headers. The ingress must enforce connection limits,
+   header/body read deadlines, and request quotas in addition to the
+   application's five-second request-body timeout.
 4. Run multiple stateless instances only after PostgreSQL conformance and
    concurrency tests pass.
 5. Add structured audit export, metrics, tracing correlation, alerts, backup,
@@ -33,4 +35,3 @@ production gate acceptance.
 Chat threads are not push subscribers. A client, automation, or PA invocation
 must call `sync_since(last_cursor)`. The cursor itself belongs in durable client
 state and is advanced only after successful processing.
-