Harden API security: input validation, safe auth extraction, new tests, and deploy config

Comprehensive security hardening from audit findings:
- Add validation tags to all DTO request structs (max lengths, ranges, enums)
- Replace unsafe type assertions with MustGetAuthUser helper across all handlers
- Remove query-param token auth from admin middleware (prevents URL token leakage)
- Add request validation calls in handlers that were missing c.Validate()
- Remove goroutines in handlers (timezone update now synchronous)
- Add sanitize middleware and path traversal protection (path_utils)
- Stop resetting admin passwords on migration restart
- Warn on well-known default SECRET_KEY
- Add ~30 new test files covering security regressions, auth safety, repos, and services
- Add deploy/ config, audit digests, and AUDIT_FINDINGS documentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

deploy/cluster.env.example

@@ -0,0 +1,22 @@
+# Swarm manager connection
+DEPLOY_MANAGER_HOST=CHANGEME_MANAGER_IP_OR_HOSTNAME
+DEPLOY_MANAGER_USER=deploy
+DEPLOY_MANAGER_SSH_PORT=22
+DEPLOY_SSH_KEY_PATH=~/.ssh/id_ed25519
+
+# Stack settings
+DEPLOY_STACK_NAME=casera
+DEPLOY_REMOTE_DIR=/opt/casera/deploy
+DEPLOY_WAIT_SECONDS=420
+DEPLOY_HEALTHCHECK_URL=https://api.casera.app/api/health/
+
+# Replicas and published ports
+API_REPLICAS=3
+WORKER_REPLICAS=2
+ADMIN_REPLICAS=1
+API_PORT=8000
+ADMIN_PORT=3000
+DOZZLE_PORT=9999
+
+# Build behavior
+PUSH_LATEST_TAG=true