docs: update READMEs with accurate line counts and feature parity status

- Node.js README: Update to 100% parity, document rate limiting and validation middleware
- Rust README: Update line counts (1,667 main.rs, 647 tests.rs)
- reference-apps README: Update Rust to 100% parity, add Node.js status and features

Author: NormB

reference-apps/README.md

@@ -23,7 +23,7 @@
 - [API Documentation](#api-documentation)
   - [3. Go Reference API](#3-go-reference-api)
   - [4. Node.js Reference API](#4-nodejs-reference-api)
-  - [5. Rust Reference API (Partial Implementation)](#5-rust-reference-api-partial-implementation)
+  - [5. Rust Reference API](#5-rust-reference-api)
 - [Future Reference Apps](#future-reference-apps)
 - [Common Use Cases](#common-use-cases)
   - [1. Testing Infrastructure Setup](#1-testing-infrastructure-setup)
@@ -373,6 +373,7 @@ curl http://localhost:8002/health/all
 **Location:** `reference-apps/nodejs/`
 **Port:** 8003 (HTTP), 8446 (HTTPS)
 **Pattern:** Modern async/await patterns with Express
+**Status:** ✅ **Feature-Complete (100% parity)**
 
 **What it demonstrates:**
 - ✅ **Same infrastructure integrations** as other implementations
@@ -381,6 +382,8 @@ curl http://localhost:8002/health/all
 - ✅ **Express middleware** - Modular request processing
 - ✅ **Winston logging** - Structured logging with correlation IDs
 - ✅ **Graceful shutdown** - Clean signal handling
+- ✅ **Rate limiting** - IP-based rate limiting (100/min default, 10/min strict, 1000/min high)
+- ✅ **Request validation** - Field presence, type checking, and constraint validation
 
 **Quick Start:**
 ```bash
@@ -403,7 +406,7 @@ curl http://localhost:8003/health/all
 **Location:** `reference-apps/rust/`
 **Port:** 8004 (HTTP), 8447 (HTTPS)
 **Pattern:** High-performance async with Actix-web
-**Status:** ✅ **Feature-Complete (~95% parity)**
+**Status:** ✅ **Feature-Complete (100% parity)**
 
 **What it demonstrates:**
 - ✅ **Complete infrastructure integration** - All services: Vault, PostgreSQL, MySQL, MongoDB, Redis, RabbitMQ
@@ -421,7 +424,7 @@ curl http://localhost:8003/health/all
 - ✅ **Async/await patterns** - Modern Rust async programming throughout
 - ✅ **Production-grade error handling** - Zero unwrap() calls, proper Result<T, E> usage
 - ✅ **Comprehensive testing** - 44 unit tests (positive, negative, edge cases)
-- ✅ **1,985 lines of production code** - Fully documented implementation
+- ✅ **2,314 lines of production code** - Fully documented implementation (1,667 main + 647 tests)
 
 **Quick Start:**
 ```bash
@@ -582,6 +585,8 @@ Reference apps demonstrate integration patterns but **not production security**:
 
 **For production:** Implement proper auth, use AppRole/JWT for Vault, add validation, monitoring, etc.
 
+**Note:** Node.js reference app now includes rate limiting middleware (default 100/min, strict 10/min, high 1000/min) and request validation as production examples.
+
 ## Getting Help
 
 **Documentation:**

reference-apps/nodejs/README.md

@@ -2,15 +2,15 @@
 
 ## ✅ **FEATURE-COMPLETE IMPLEMENTATION** ✅
 
-**Production-ready Node.js implementation with ~95% feature parity** with Python, Rust, Go, and TypeScript reference APIs.
+**Production-ready Node.js implementation with 100% feature parity** with Python, Rust, Go, and TypeScript reference APIs.
 
 **⚠️ This is a reference implementation for learning and testing. Not intended for production use.**
 
 A modern Node.js/Express application demonstrating infrastructure integration patterns with async/await, Promise-based concurrency, structured logging, and comprehensive observability.
 
 ### Implementation Highlights
 
-- **1,368 lines** of production-ready JavaScript code
+- **2,161 lines** of production-ready JavaScript code
 - **Complete infrastructure integration** - All services: Vault, PostgreSQL, MySQL, MongoDB, Redis, RabbitMQ
 - **Modern async/await** - Clean asynchronous patterns throughout
 - **Promise.allSettled** - Concurrent health checks for all services
@@ -73,6 +73,8 @@ A Node.js/Express application demonstrating infrastructure integration patterns
 - **Health Monitoring**: Comprehensive health checks for all services
 - **Observability**: Prometheus metrics, structured logging with Winston
 - **Security**: Helmet, CORS, request ID correlation
+- **Rate Limiting**: IP-based rate limiting with configurable limits (default 100/min, strict 10/min, high 1000/min)
+- **Request Validation**: Field presence, type checking, and constraint validation middleware
 
 ### Node.js-Specific Features
 - **Async/Await**: Modern asynchronous patterns throughout
@@ -149,7 +151,9 @@ reference-apps/nodejs/
 │   │   └── vault.js          # Vault client wrapper
 │   └── middleware/           # Express middleware
 │       ├── logging.js        # Request logging with correlation IDs
-│       └── cors.js           # CORS configuration
+│       ├── cors.js           # CORS configuration
+│       ├── rate-limit.js     # IP-based rate limiting (100/min default)
+│       └── validation.js     # Request validation middleware
 ├── tests/                    # Test suite
 ├── Dockerfile               # Container build
 ├── package.json             # Dependencies
@@ -289,7 +293,7 @@ npm test -- --coverage
 
 ## What This Is NOT
 
-❌ **Not production-ready** - Missing security hardening, rate limiting improvements
+❌ **Not production-ready** - Reference implementation for learning, not hardened for production
 ❌ **Not feature-complete** - Focuses on integration patterns, not business logic
 ❌ **Not optimized** - Simple implementations for learning
 ❌ **Not secure** - Uses root Vault token for simplicity

reference-apps/rust/README.md

@@ -95,8 +95,8 @@
 
 ### Implementation Highlights
 
-- **1,347 lines** of production-ready Rust code in `src/main.rs`
-- **638 lines** of comprehensive tests in `src/tests.rs`
+- **1,667 lines** of production-ready Rust code in `src/main.rs`
+- **647 lines** of comprehensive tests in `src/tests.rs`
 - **Zero unsafe code** - 100% safe Rust
 - **Zero unwrap() calls** in production paths (per CLAUDE.md guidelines)
 - **Type-safe** - Compile-time guarantees prevent entire classes of bugs