Fix 113 hardening issues across entire Go backend

Security:
- Replace all binding: tags with validate: + c.Validate() in admin handlers
- Add rate limiting to auth endpoints (login, register, password reset)
- Add security headers (HSTS, XSS protection, nosniff, frame options)
- Wire Google Pub/Sub token verification into webhook handler
- Replace ParseUnverified with proper OIDC/JWKS key verification
- Verify inner Apple JWS signatures in webhook handler
- Add io.LimitReader (1MB) to all webhook body reads
- Add ownership verification to file deletion
- Move hardcoded admin credentials to env vars
- Add uniqueIndex to User.Email
- Hide ConfirmationCode from JSON serialization
- Mask confirmation codes in admin responses
- Use http.DetectContentType for upload validation
- Fix path traversal in storage service
- Replace os.Getenv with Viper in stripe service
- Sanitize Redis URLs before logging
- Separate DEBUG_FIXED_CODES from DEBUG flag
- Reject weak SECRET_KEY in production
- Add host check on /_next/* proxy routes
- Use explicit localhost CORS origins in debug mode
- Replace err.Error() with generic messages in all admin error responses

Critical fixes:
- Rewrite FCM to HTTP v1 API with OAuth 2.0 service account auth
- Fix user_customuser -> auth_user table names in raw SQL
- Fix dashboard verified query to use UserProfile model
- Add escapeLikeWildcards() to prevent SQL wildcard injection

Bug fixes:
- Add bounds checks for days/expiring_soon query params (1-3650)
- Add receipt_data/transaction_id empty-check to RestoreSubscription
- Change Active bool -> *bool in device handler
- Check all unchecked GORM/FindByIDWithProfile errors
- Add validation for notification hour fields (0-23)
- Add max=10000 validation on task description updates

Transactions & data integrity:
- Wrap registration flow in transaction
- Wrap QuickComplete in transaction
- Move image creation inside completion transaction
- Wrap SetSpecialties in transaction
- Wrap GetOrCreateToken in transaction
- Wrap completion+image deletion in transaction

Performance:
- Batch completion summaries (2 queries vs 2N)
- Reuse single http.Client in IAP validation
- Cache dashboard counts (30s TTL)
- Batch COUNT queries in admin user list
- Add Limit(500) to document queries
- Add reminder_stage+due_date filters to reminder queries
- Parse AllowedTypes once at init
- In-memory user cache in auth middleware (30s TTL)
- Timezone change detection cache
- Optimize P95 with per-endpoint sorted buffers
- Replace crypto/md5 with hash/fnv for ETags

Code quality:
- Add sync.Once to all monitoring Stop()/Close() methods
- Replace 8 fmt.Printf with zerolog in auth service
- Log previously discarded errors
- Standardize delete response shapes
- Route hardcoded English through i18n
- Remove FileURL from DocumentResponse (keep MediaURL only)
- Thread user timezone through kanban board responses
- Initialize empty slices to prevent null JSON
- Extract shared field map for task Update/UpdateTx
- Delete unused SoftDeleteModel, min(), formatCron, legacy handlers

Worker & jobs:
- Wire Asynq email infrastructure into worker
- Register HandleReminderLogCleanup with daily 3AM cron
- Use per-user timezone in HandleSmartReminder
- Replace direct DB queries with repository calls
- Delete legacy reminder handlers (~200 lines)
- Delete unused task type constants

Dependencies:
- Replace archived jung-kurt/gofpdf with go-pdf/fpdf
- Replace unmaintained gomail.v2 with wneessen/go-mail
- Add TODO for Echo jwt v3 transitive dep removal

Test infrastructure:
- Fix MakeRequest/SeedLookupData error handling
- Replace os.Exit(0) with t.Skip() in scope/consistency tests
- Add 11 new FCM v1 tests

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/monitoring/middleware.go

@@ -10,39 +10,33 @@ import (
 
 // HTTPStatsCollector collects HTTP request metrics
 type HTTPStatsCollector struct {
-	mu           sync.RWMutex
-	requests     map[string]int64         // endpoint -> count
-	totalLatency map[string]time.Duration // endpoint -> total latency
-	errors       map[string]int64         // endpoint -> error count
-	byStatus     map[int]int64            // status code -> count
-	latencies    []latencySample          // recent latency samples for P95
-	startTime    time.Time
-	lastReset    time.Time
-}
-
-type latencySample struct {
-	endpoint  string
-	latency   time.Duration
-	timestamp time.Time
+	mu                  sync.RWMutex
+	requests            map[string]int64         // endpoint -> count
+	totalLatency        map[string]time.Duration // endpoint -> total latency
+	errors              map[string]int64         // endpoint -> error count
+	byStatus            map[int]int64            // status code -> count
+	endpointLatencies   map[string][]time.Duration // per-endpoint sorted latency buffers for P95
+	startTime           time.Time
+	lastReset           time.Time
 }
 
 const (
-	maxLatencySamples = 1000
-	maxEndpoints      = 200          // Cap unique endpoints tracked
-	statsResetPeriod  = 1 * time.Hour // Reset stats periodically to prevent unbounded growth
+	maxLatencySamplesPerEndpoint = 200  // Max latency samples kept per endpoint
+	maxEndpoints                = 200  // Cap unique endpoints tracked
+	statsResetPeriod            = 1 * time.Hour // Reset stats periodically to prevent unbounded growth
 )
 
 // NewHTTPStatsCollector creates a new HTTP stats collector
 func NewHTTPStatsCollector() *HTTPStatsCollector {
 	now := time.Now()
 	return &HTTPStatsCollector{
-		requests:     make(map[string]int64),
-		totalLatency: make(map[string]time.Duration),
-		errors:       make(map[string]int64),
-		byStatus:     make(map[int]int64),
-		latencies:    make([]latencySample, 0, maxLatencySamples),
-		startTime:    now,
-		lastReset:    now,
+		requests:          make(map[string]int64),
+		totalLatency:      make(map[string]time.Duration),
+		errors:            make(map[string]int64),
+		byStatus:          make(map[int]int64),
+		endpointLatencies: make(map[string][]time.Duration),
+		startTime:         now,
+		lastReset:         now,
 	}
 }
 
@@ -70,17 +64,22 @@ func (c *HTTPStatsCollector) Record(endpoint string, latency time.Duration, stat
 		c.errors[endpoint]++
 	}
 
-	// Store latency sample
-	c.latencies = append(c.latencies, latencySample{
-		endpoint:  endpoint,
-		latency:   latency,
-		timestamp: time.Now(),
+	// Insert latency into per-endpoint sorted buffer using binary search
+	buf := c.endpointLatencies[endpoint]
+	idx := sort.Search(len(buf), func(i int) bool {
+		return buf[i] >= latency
 	})
+	buf = append(buf, 0)
+	copy(buf[idx+1:], buf[idx:])
+	buf[idx] = latency
 
-	// Keep only recent samples
-	if len(c.latencies) > maxLatencySamples {
-		c.latencies = c.latencies[len(c.latencies)-maxLatencySamples:]
+	// Trim to max samples per endpoint by removing the median element
+	// to preserve distribution tails (important for P95 accuracy)
+	if len(buf) > maxLatencySamplesPerEndpoint {
+		mid := len(buf) / 2
+		buf = append(buf[:mid], buf[mid+1:]...)
 	}
+	c.endpointLatencies[endpoint] = buf
 }
 
 // resetLocked resets stats while holding the lock
@@ -89,7 +88,7 @@ func (c *HTTPStatsCollector) resetLocked() {
 	c.totalLatency = make(map[string]time.Duration)
 	c.errors = make(map[string]int64)
 	c.byStatus = make(map[int]int64)
-	c.latencies = make([]latencySample, 0, maxLatencySamples)
+	c.endpointLatencies = make(map[string][]time.Duration)
 	c.lastReset = time.Now()
 	// Keep startTime for uptime calculation
 }
@@ -147,33 +146,23 @@ func (c *HTTPStatsCollector) GetStats() HTTPStats {
 	return stats
 }
 
-// calculateP95 calculates the 95th percentile latency for an endpoint
-// Must be called with read lock held
+// calculateP95 calculates the 95th percentile latency for an endpoint.
+// The per-endpoint buffer is maintained in sorted order during insertion,
+// so this is an O(1) index lookup.
+// Must be called with read lock held.
 func (c *HTTPStatsCollector) calculateP95(endpoint string) float64 {
-	var endpointLatencies []time.Duration
-
-	for _, sample := range c.latencies {
-		if sample.endpoint == endpoint {
-			endpointLatencies = append(endpointLatencies, sample.latency)
-		}
-	}
-
-	if len(endpointLatencies) == 0 {
+	buf := c.endpointLatencies[endpoint]
+	if len(buf) == 0 {
 		return 0
 	}
 
-	// Sort latencies
-	sort.Slice(endpointLatencies, func(i, j int) bool {
-		return endpointLatencies[i] < endpointLatencies[j]
-	})
-
-	// Calculate P95 index
-	p95Index := int(float64(len(endpointLatencies)) * 0.95)
-	if p95Index >= len(endpointLatencies) {
-		p95Index = len(endpointLatencies) - 1
+	// Buffer is already sorted; direct index lookup
+	p95Index := int(float64(len(buf)) * 0.95)
+	if p95Index >= len(buf) {
+		p95Index = len(buf) - 1
 	}
 
-	return float64(endpointLatencies[p95Index].Milliseconds())
+	return float64(buf[p95Index].Milliseconds())
 }
 
 // Reset clears all collected stats
@@ -185,7 +174,7 @@ func (c *HTTPStatsCollector) Reset() {
 	c.totalLatency = make(map[string]time.Duration)
 	c.errors = make(map[string]int64)
 	c.byStatus = make(map[int]int64)
-	c.latencies = make([]latencySample, 0, maxLatencySamples)
+	c.endpointLatencies = make(map[string][]time.Duration)
 	c.startTime = time.Now()
 }