feat: add CodeQL SAST, rate limiting, pagination, and architecture diagram

- Add CodeQL workflow for Python and JavaScript/TypeScript security analysis
- Add rate limiting with in-memory or Redis backend support
- Add PaginatedResponse[T] generic model for consistent pagination
- Add mermaid architecture diagram to README files

Author: gracefullight

.github/workflows/codeql.yml

@@ -0,0 +1,44 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "0 6 * * 1" # Every Monday at 6 AM UTC
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      packages: read
+      actions: read
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: javascript-typescript
+            build-mode: none
+          - language: python
+            build-mode: none
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          queries: security-extended
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"

README.ko.md

@@ -4,6 +4,41 @@
 
 프로덕션 레디 풀스택 모노레포 템플릿. Next.js 16, FastAPI, Flutter, GCP 인프라를 포함합니다.
 
+```mermaid
+graph TB
+    subgraph Client["클라이언트"]
+        Web[Next.js 16<br/>React 19]
+        Mobile[Flutter 3.32<br/>Riverpod]
+    end
+
+    subgraph GCP["GCP Cloud Run"]
+        API[FastAPI<br/>Python 3.13]
+        Worker[Worker<br/>CloudTasks]
+    end
+
+    subgraph Data["데이터"]
+        DB[(PostgreSQL 16)]
+        Cache[(Redis 7)]
+        Storage[(Cloud Storage)]
+    end
+
+    Web --> API
+    Mobile --> API
+    API --> DB
+    API --> Cache
+    API --> Worker
+    Worker --> DB
+    API --> Storage
+
+    style Web fill:#0070f3,color:#fff
+    style Mobile fill:#02569B,color:#fff
+    style API fill:#009688,color:#fff
+    style Worker fill:#009688,color:#fff
+    style DB fill:#336791,color:#fff
+    style Cache fill:#DC382D,color:#fff
+    style Storage fill:#4285F4,color:#fff
+```
+
 ## 주요 기능
 
 - **모던 스택**: Next.js 16 + React 19, FastAPI, Flutter 3.32, TailwindCSS v4

README.md

@@ -4,6 +4,41 @@ English | [한국어](./README.ko.md)
 
 Production-ready fullstack monorepo template with Next.js 16, FastAPI, Flutter, and GCP infrastructure.
 
+```mermaid
+graph TB
+    subgraph Client
+        Web[Next.js 16<br/>React 19]
+        Mobile[Flutter 3.32<br/>Riverpod]
+    end
+
+    subgraph GCP["GCP Cloud Run"]
+        API[FastAPI<br/>Python 3.13]
+        Worker[Worker<br/>CloudTasks]
+    end
+
+    subgraph Data
+        DB[(PostgreSQL 16)]
+        Cache[(Redis 7)]
+        Storage[(Cloud Storage)]
+    end
+
+    Web --> API
+    Mobile --> API
+    API --> DB
+    API --> Cache
+    API --> Worker
+    Worker --> DB
+    API --> Storage
+
+    style Web fill:#0070f3,color:#fff
+    style Mobile fill:#02569B,color:#fff
+    style API fill:#009688,color:#fff
+    style Worker fill:#009688,color:#fff
+    style DB fill:#336791,color:#fff
+    style Cache fill:#DC382D,color:#fff
+    style Storage fill:#4285F4,color:#fff
+```
+
 ## Key Features
 
 - **Modern Stack**: Next.js 16 + React 19, FastAPI, Flutter 3.32, TailwindCSS v4

apps/api/src/common/models/__init__.py

@@ -0,0 +1,16 @@
+"""Common models for the API."""
+
+from src.common.models.base import TimestampMixin, UUIDMixin
+from src.common.models.pagination import (
+    PaginatedResponse,
+    PaginationMeta,
+    PaginationParams,
+)
+
+__all__ = [
+    "TimestampMixin",
+    "UUIDMixin",
+    "PaginatedResponse",
+    "PaginationMeta",
+    "PaginationParams",
+]

apps/api/src/common/models/pagination.py

@@ -0,0 +1,71 @@
+"""Pagination models and utilities."""
+
+from typing import Generic, TypeVar
+
+from pydantic import BaseModel, Field
+
+T = TypeVar("T")
+
+
+class PaginationParams(BaseModel):
+    """Query parameters for pagination."""
+
+    page: int = Field(default=1, ge=1, description="Page number (1-indexed)")
+    limit: int = Field(default=20, ge=1, le=100, description="Items per page")
+
+    @property
+    def offset(self) -> int:
+        """Calculate offset for database query."""
+        return (self.page - 1) * self.limit
+
+
+class PaginationMeta(BaseModel):
+    """Pagination metadata."""
+
+    page: int = Field(description="Current page number")
+    limit: int = Field(description="Items per page")
+    total: int = Field(description="Total number of items")
+    total_pages: int = Field(description="Total number of pages")
+    has_next: bool = Field(description="Whether there is a next page")
+    has_prev: bool = Field(description="Whether there is a previous page")
+
+
+class PaginatedResponse(BaseModel, Generic[T]):
+    """Generic paginated response wrapper."""
+
+    data: list[T]
+    meta: PaginationMeta
+
+    @classmethod
+    def create(
+        cls,
+        data: list[T],
+        total: int,
+        page: int,
+        limit: int,
+    ) -> "PaginatedResponse[T]":
+        """
+        Create a paginated response.
+
+        Args:
+            data: List of items for the current page
+            total: Total number of items across all pages
+            page: Current page number (1-indexed)
+            limit: Items per page
+
+        Returns:
+            PaginatedResponse with data and metadata
+        """
+        total_pages = (total + limit - 1) // limit if total > 0 else 0
+
+        return cls(
+            data=data,
+            meta=PaginationMeta(
+                page=page,
+                limit=limit,
+                total=total,
+                total_pages=total_pages,
+                has_next=page < total_pages,
+                has_prev=page > 1,
+            ),
+        )