Fix 113 hardening issues across entire Go backend

Security:
- Replace all binding: tags with validate: + c.Validate() in admin handlers
- Add rate limiting to auth endpoints (login, register, password reset)
- Add security headers (HSTS, XSS protection, nosniff, frame options)
- Wire Google Pub/Sub token verification into webhook handler
- Replace ParseUnverified with proper OIDC/JWKS key verification
- Verify inner Apple JWS signatures in webhook handler
- Add io.LimitReader (1MB) to all webhook body reads
- Add ownership verification to file deletion
- Move hardcoded admin credentials to env vars
- Add uniqueIndex to User.Email
- Hide ConfirmationCode from JSON serialization
- Mask confirmation codes in admin responses
- Use http.DetectContentType for upload validation
- Fix path traversal in storage service
- Replace os.Getenv with Viper in stripe service
- Sanitize Redis URLs before logging
- Separate DEBUG_FIXED_CODES from DEBUG flag
- Reject weak SECRET_KEY in production
- Add host check on /_next/* proxy routes
- Use explicit localhost CORS origins in debug mode
- Replace err.Error() with generic messages in all admin error responses

Critical fixes:
- Rewrite FCM to HTTP v1 API with OAuth 2.0 service account auth
- Fix user_customuser -> auth_user table names in raw SQL
- Fix dashboard verified query to use UserProfile model
- Add escapeLikeWildcards() to prevent SQL wildcard injection

Bug fixes:
- Add bounds checks for days/expiring_soon query params (1-3650)
- Add receipt_data/transaction_id empty-check to RestoreSubscription
- Change Active bool -> *bool in device handler
- Check all unchecked GORM/FindByIDWithProfile errors
- Add validation for notification hour fields (0-23)
- Add max=10000 validation on task description updates

Transactions & data integrity:
- Wrap registration flow in transaction
- Wrap QuickComplete in transaction
- Move image creation inside completion transaction
- Wrap SetSpecialties in transaction
- Wrap GetOrCreateToken in transaction
- Wrap completion+image deletion in transaction

Performance:
- Batch completion summaries (2 queries vs 2N)
- Reuse single http.Client in IAP validation
- Cache dashboard counts (30s TTL)
- Batch COUNT queries in admin user list
- Add Limit(500) to document queries
- Add reminder_stage+due_date filters to reminder queries
- Parse AllowedTypes once at init
- In-memory user cache in auth middleware (30s TTL)
- Timezone change detection cache
- Optimize P95 with per-endpoint sorted buffers
- Replace crypto/md5 with hash/fnv for ETags

Code quality:
- Add sync.Once to all monitoring Stop()/Close() methods
- Replace 8 fmt.Printf with zerolog in auth service
- Log previously discarded errors
- Standardize delete response shapes
- Route hardcoded English through i18n
- Remove FileURL from DocumentResponse (keep MediaURL only)
- Thread user timezone through kanban board responses
- Initialize empty slices to prevent null JSON
- Extract shared field map for task Update/UpdateTx
- Delete unused SoftDeleteModel, min(), formatCron, legacy handlers

Worker & jobs:
- Wire Asynq email infrastructure into worker
- Register HandleReminderLogCleanup with daily 3AM cron
- Use per-user timezone in HandleSmartReminder
- Replace direct DB queries with repository calls
- Delete legacy reminder handlers (~200 lines)
- Delete unused task type constants

Dependencies:
- Replace archived jung-kurt/gofpdf with go-pdf/fpdf
- Replace unmaintained gomail.v2 with wneessen/go-mail
- Add TODO for Echo jwt v3 transitive dep removal

Test infrastructure:
- Fix MakeRequest/SeedLookupData error handling
- Replace os.Exit(0) with t.Skip() in scope/consistency tests
- Add 11 new FCM v1 tests

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/testutil/testutil.go

@@ -3,6 +3,7 @@ package testutil
 import (
 	"bytes"
 	"encoding/json"
+	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"sync"
@@ -71,7 +72,12 @@ func SetupTestDB(t *testing.T) *gorm.DB {
 	return db
 }
 
-// SetupTestRouter creates a test Echo router with the custom error handler
+// SetupTestRouter creates a test Echo router with the custom error handler.
+// Uses apperrors.HTTPErrorHandler which is the base error handler shared with
+// production (router.customHTTPErrorHandler). Both handle AppError, ValidationErrors,
+// and echo.HTTPError identically. Production additionally maps legacy service sentinel
+// errors (e.g., services.ErrTaskNotFound) which are being migrated to AppError types.
+// Tests exercise handlers that return AppError, so this handler covers all test scenarios.
 func SetupTestRouter() *echo.Echo {
 	e := echo.New()
 	e.Validator = validator.NewCustomValidator()
@@ -79,17 +85,52 @@ func SetupTestRouter() *echo.Echo {
 	return e
 }
 
-// MakeRequest makes a test HTTP request and returns the response
+// MakeRequest makes a test HTTP request and returns the response.
+// Errors from JSON marshaling and HTTP request construction are checked and
+// will panic if they occur, since these indicate programming errors in tests.
+// Prefer MakeRequestT for new tests, which uses t.Fatal for better reporting.
 func MakeRequest(router *echo.Echo, method, path string, body interface{}, token string) *httptest.ResponseRecorder {
 	var reqBody *bytes.Buffer
 	if body != nil {
-		jsonBody, _ := json.Marshal(body)
+		jsonBody, err := json.Marshal(body)
+		if err != nil {
+			panic(fmt.Sprintf("testutil.MakeRequest: failed to marshal request body: %v", err))
+		}
 		reqBody = bytes.NewBuffer(jsonBody)
 	} else {
 		reqBody = bytes.NewBuffer(nil)
 	}
 
-	req, _ := http.NewRequest(method, path, reqBody)
+	req, err := http.NewRequest(method, path, reqBody)
+	if err != nil {
+		panic(fmt.Sprintf("testutil.MakeRequest: failed to create HTTP request: %v", err))
+	}
+	req.Header.Set("Content-Type", "application/json")
+	if token != "" {
+		req.Header.Set("Authorization", "Token "+token)
+	}
+
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	return rec
+}
+
+// MakeRequestT is like MakeRequest but accepts a *testing.T for proper test
+// failure reporting. Prefer this over MakeRequest in new tests.
+func MakeRequestT(t *testing.T, router *echo.Echo, method, path string, body interface{}, token string) *httptest.ResponseRecorder {
+	t.Helper()
+
+	var reqBody *bytes.Buffer
+	if body != nil {
+		jsonBody, err := json.Marshal(body)
+		require.NoError(t, err, "failed to marshal request body")
+		reqBody = bytes.NewBuffer(jsonBody)
+	} else {
+		reqBody = bytes.NewBuffer(nil)
+	}
+
+	req, err := http.NewRequest(method, path, reqBody)
+	require.NoError(t, err, "failed to create HTTP request")
 	req.Header.Set("Content-Type", "application/json")
 	if token != "" {
 		req.Header.Set("Authorization", "Token "+token)
@@ -215,8 +256,12 @@ func CreateTestTask(t *testing.T, db *gorm.DB, residenceID, createdByID uint, ti
 	return task
 }
 
-// SeedLookupData seeds all lookup tables with test data
+// SeedLookupData seeds all lookup tables with test data.
+// All GORM create operations are checked for errors to prevent silent failures
+// that could cause misleading test results.
 func SeedLookupData(t *testing.T, db *gorm.DB) {
+	t.Helper()
+
 	// Residence types
 	residenceTypes := []models.ResidenceType{
 		{Name: "House"},
@@ -224,8 +269,9 @@ func SeedLookupData(t *testing.T, db *gorm.DB) {
 		{Name: "Condo"},
 		{Name: "Townhouse"},
 	}
-	for _, rt := range residenceTypes {
-		db.Create(&rt)
+	for i := range residenceTypes {
+		err := db.Create(&residenceTypes[i]).Error
+		require.NoError(t, err, "failed to seed residence type: %s", residenceTypes[i].Name)
 	}
 
 	// Task categories
@@ -235,8 +281,9 @@ func SeedLookupData(t *testing.T, db *gorm.DB) {
 		{Name: "HVAC", DisplayOrder: 3},
 		{Name: "General", DisplayOrder: 99},
 	}
-	for _, c := range categories {
-		db.Create(&c)
+	for i := range categories {
+		err := db.Create(&categories[i]).Error
+		require.NoError(t, err, "failed to seed task category: %s", categories[i].Name)
 	}
 
 	// Task priorities
@@ -246,8 +293,9 @@ func SeedLookupData(t *testing.T, db *gorm.DB) {
 		{Name: "High", Level: 3, DisplayOrder: 3},
 		{Name: "Urgent", Level: 4, DisplayOrder: 4},
 	}
-	for _, p := range priorities {
-		db.Create(&p)
+	for i := range priorities {
+		err := db.Create(&priorities[i]).Error
+		require.NoError(t, err, "failed to seed task priority: %s", priorities[i].Name)
 	}
 
 	// Task frequencies
@@ -258,8 +306,9 @@ func SeedLookupData(t *testing.T, db *gorm.DB) {
 		{Name: "Weekly", Days: &days7, DisplayOrder: 2},
 		{Name: "Monthly", Days: &days30, DisplayOrder: 3},
 	}
-	for _, f := range frequencies {
-		db.Create(&f)
+	for i := range frequencies {
+		err := db.Create(&frequencies[i]).Error
+		require.NoError(t, err, "failed to seed task frequency: %s", frequencies[i].Name)
 	}
 
 	// Contractor specialties
@@ -269,8 +318,9 @@ func SeedLookupData(t *testing.T, db *gorm.DB) {
 		{Name: "HVAC Technician"},
 		{Name: "Handyman"},
 	}
-	for _, s := range specialties {
-		db.Create(&s)
+	for i := range specialties {
+		err := db.Create(&specialties[i]).Error
+		require.NoError(t, err, "failed to seed contractor specialty: %s", specialties[i].Name)
 	}
 }