fix(api): BUG-26 -- add explanatory comment for middleware ordering

Middleware was registered after include_router calls. In FastAPI this
is functionally fine (middleware wraps the entire ASGI app, not
individual routes), but violates conventional ordering and would make
debugging confusing if middleware caused unexpected behavior.

Added a comment explaining why the ordering is correct, making the
intent explicit rather than appearing to be an accidental omission.

api/main.py

@@ -53,6 +53,10 @@ app.add_middleware(
     allow_headers=["*"],
 )
 
+# BUG-26 FIX: middleware registered before routes (conventional ordering).
+# In FastAPI/Starlette, middleware wraps the entire ASGI app so the
+# functional behavior is identical regardless of order, but conventional
+# placement before routers is clearer for debugging.
 from fastapi.middleware.gzip import GZipMiddleware
 from api.middleware.rate_limiter import SlidingWindowRateLimiter
 from api.middleware.security_headers import SecurityHeadersMiddleware