Fix test suite and improve security documentation

- Removed broken test that referenced deleted customEndpointHandler
- Removed unused import for createPayloadRequest
- Added production security best practices to README including API key authentication example
- Added rate limiting example for production use
- Added client-side caching recommendations for performance optimization

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

dev/int.spec.ts

@@ -1,11 +1,9 @@
 import type { Payload } from 'payload'
 
 import config from '@payload-config'
-import { createPayloadRequest, getPayload } from 'payload'
+import { getPayload } from 'payload'
 import { afterAll, beforeAll, describe, expect, test } from 'vitest'
 
-import { customEndpointHandler } from '../src/endpoints/customEndpointHandler.js'
-
 let payload: Payload
 
 afterAll(async () => {
@@ -17,21 +15,6 @@ beforeAll(async () => {
 })
 
 describe('Plugin integration tests', () => {
-  test('should query custom endpoint added by plugin', async () => {
-    const request = new Request('http://localhost:3000/api/my-plugin-endpoint', {
-      method: 'GET',
-    })
-
-    const payloadRequest = await createPayloadRequest({ config, request })
-    const response = await customEndpointHandler(payloadRequest)
-    expect(response.status).toBe(200)
-
-    const data = await response.json()
-    expect(data).toMatchObject({
-      message: 'Hello from custom endpoint',
-    })
-  })
-
   test('can create post with custom text field added by plugin', async () => {
     const post = await payload.create({
       collection: 'posts',