Small cleanups: deprecated on_event startup, Python version claims, cold-start ADR wording, rate-limit test coverage #45

Four small items, none urgent, plus one warning seen in the same test run.

1. @app.on_event("startup") is deprecated. With the pinned FastAPI 0.139.2, pytest -W default reports main.py:79: DeprecationWarning: on_event is deprecated, use lifespan event handlers instead. Moving startup() into a lifespan context manager keeps the same behaviour (log and start degraded on failure).
2. Python version claims do not line up. The README.md badge says "Python 3.12+", the Dockerfile uses python:3.14-slim, and Dependabot build(deps): bump python from 3.14-slim to 3.15-slim #37 proposes python:3.15-slim. No CI runs any version, so the stated floor is not verified (the suite also passes locally on 3.10). Pick a supported range and test it once CI exists.
3. The hosting ADR misdescribes scale-to-zero. ARCHITECTURE.md says "--min-instances 0 keeps it free at idle the same way Render's sleep did, just without the cold-start latency on wake." With --min-instances 0, Cloud Run scales to zero and the next request does cold start, as README.md's own Deployment section says ("scales to zero at idle"). The sentence should say it trades a cold start for no idle cost, as Render's sleep did.
4. test_every_route_is_rate_limited only tests /records. Its name promises more. fix: make the index refresh its cache and report an honest status #40 adds a test for /, but /records/{ave_id}, /records/{ave_id}/mitigation and /search are still not covered. A test parametrized over every route would match the name and catch a route added without @limiter.limit(...), which CLAUDE.md calls a gap in coverage.

Also seen in the same run: fastapi/testclient.py:1: StarletteDeprecationWarning: Using httpx with starlette.testclient is deprecated; install httpx2 instead. This comes from the test dependency set, not from this repo's code.