feat: add guarded k6 load-testing examples

[HoungDev]

Summary

• add bounded k6 profiles for liveness and authenticated API traffic
• give every virtual user an isolated account and refresh-token family
• reject remote targets unless explicitly authorized
• enforce starting thresholds for checks, workload failures, p95, and p99
• document safe staged execution and mark the v1.3 roadmap item complete

Why

The database benchmark merged in #45 intentionally excludes HTTP, JWT, bcrypt, middleware, Redis, and response serialization. This PR adds the remaining end-to-end load-testing example without treating noisy shared-runner timings as production evidence.

Safety

The script targets localhost by default, refuses remote hosts unless ALLOW_REMOTE_TARGET=true, and documents that it must use a disposable database or authorized staging environment. Generated users are not automatically deleted.

Validation

• Ruff lint passed
• Ruff format check passed (185 files)
• documentation-link and load-test contract validation passed
• file scope compared against merge commit fae4cc1: six intended files only
• full pytest and live k6 execution were not available locally because this environment has no PostgreSQL service and could not download the k6 binary; GitHub CI should provide the database-backed suite

Review notes

The thresholds are documented as starting points rather than universal SLOs. CI should validate correctness only; controlled staging runs should retain performance evidence.