Add production considerations section

README.md

@@ -81,6 +81,13 @@ JWT_SECRET=dev-secret-change-me-do-not-use-in-production mvn spring-boot:run
 - Additional production-grade coverage would include update/delete/share mutation tests, PostgreSQL integration tests, and coverage reporting.
 - Future improvements could include OpenAPI documentation, audit logging, rate limiting, structured request logging, health checks, metrics, and CI/CD automation.
 
+## Production considerations
+
+- Deployment: package the Spring Boot service as a container, run it behind HTTPS, and connect it to a managed PostgreSQL database. Secrets such as `JWT_SECRET` should come from the deployment platform's secret manager rather than source control or image defaults.
+- Monitoring and alerts: track request latency, 4xx/5xx rates, authentication failures, database connection pool health, migration failures, and unexpected exception counts. Alert on sustained 5xx responses, database connectivity issues, and spikes in failed logins.
+- Database migrations: continue using Flyway versioned migrations. In production, migrations should be reviewed, tested against staging data, and applied as part of a controlled deployment process.
+- Scaling: the API is stateless after login, so multiple application instances can run behind a load balancer. To support higher concurrency, tune the database connection pool, add pagination to list endpoints, keep indexes aligned with access patterns, and consider caching only after measuring bottlenecks.
+
 ## Testing
 
 The automated tests run with Spring Boot, MockMvc, Spring Security, JPA, validation, and Flyway-backed H2 enabled. This keeps the tests close to real API behavior while still making them fast enough to run locally.