feat(backend): add pprof endpoints for runtime profiling #62

Problem

There are no profiling endpoints. When performance issues arise in production, there is no way to capture a CPU or memory profile without redeploying.

Acceptance criteria

• Register net/http/pprof routes under /debug/pprof/
• Gate these routes to localhost / internal network only (same pattern as /metrics)
• Document the endpoints and how to use go tool pprof in backend/docs/