Fix boot sequence alignment, rate limiter memory leak, and docs gaps

- base.js: Fix boot sequence title centering — old formula was off by 1
  char for odd-length app names (PULSE, GANDALF). Remove unused `bar`
  variable. New logic computes left/right padding independently to
  handle both even and odd title lengths correctly.
- node/middleware.js: Prune expired rate-limit entries from Map when
  size exceeds 5000 to prevent unbounded memory growth. Also use
  req.socket?.remoteAddress as fallback for req.ip.
- README.md: Document lt.beep() in the JS API section. Clarify Quick
  Start to distinguish core files from platform-specific helpers.
  Note that tableNav.init() and sortTable.init() require explicit calls.
- aesthetic_diff.md: Correct §8 toast icon format — base.js uses
  bracketed symbols [✓][✗][!][i], not >> prefix as previously stated.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

README.md

@@ -8,7 +8,7 @@ Unified layout, styling, and JavaScript utilities for all LotusGuild web applica
 
 ## Quick Start
 
-Copy three files into your app's static/public directory:
+**Core files** (needed by every app):
 
 ```
 base.css   → all variables, components, animations, responsive rules
@@ -16,6 +16,15 @@ base.js    → toast, modal, tabs, CSRF, fetch helpers, keyboard shortcuts
 base.html  → full component reference (static demo, not for production)
 ```
 
+**Platform-specific helpers** (one per backend):
+
+```
+php/layout.php          → PHP base layout with CSP nonce + CSRF injection
+python/auth.py          → Flask @require_auth / @require_admin decorators
+python/base.html        → Jinja2 base template with block inheritance
+node/middleware.js      → Express requireAuth, csrfMiddleware, cspNonce, etc.
+```
+
 Then load them in your HTML:
 
 ```html
@@ -386,6 +395,10 @@ lt.toast.error(msg, durationMs?)
 lt.toast.warning(msg, durationMs?)
 lt.toast.info(msg, durationMs?)
 
+/* Audio */
+lt.beep('success' | 'error' | 'info')  // Web Audio API beep; silent-fails if unavailable
+// Note: toasts automatically call lt.beep() — only call directly for non-toast events
+
 /* Modals */
 lt.modal.open('modal-id')
 lt.modal.close('modal-id')
@@ -424,9 +437,9 @@ lt.time.format(isoString)         // locale datetime string
 /* Bytes */
 lt.bytes.format(1234567)          // "1.18 MB"
 
-/* Table utilities */
-lt.tableNav.init('table-id')      // j/k/Enter keyboard navigation
-lt.sortTable.init('table-id')     // click-to-sort on data-sort-key headers
+/* Table utilities — must be called explicitly (not auto-initialized) */
+lt.tableNav.init('table-id')      // j/k/Enter keyboard navigation on <tbody> rows
+lt.sortTable.init('table-id')     // click-to-sort on <th data-sort-key> headers
 
 /* Stats widget filtering */
 lt.statsFilter.init()             // wires data-filter-key clicks