Harden API security: input validation, safe auth extraction, new tests, and deploy config

Comprehensive security hardening from audit findings:
- Add validation tags to all DTO request structs (max lengths, ranges, enums)
- Replace unsafe type assertions with MustGetAuthUser helper across all handlers
- Remove query-param token auth from admin middleware (prevents URL token leakage)
- Add request validation calls in handlers that were missing c.Validate()
- Remove goroutines in handlers (timezone update now synchronous)
- Add sanitize middleware and path traversal protection (path_utils)
- Stop resetting admin passwords on migration restart
- Warn on well-known default SECRET_KEY
- Add ~30 new test files covering security regressions, auth safety, repos, and services
- Add deploy/ config, audit digests, and AUDIT_FINDINGS documentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

hardening-report.md

@@ -0,0 +1,37 @@
+# Go Backend Hardening Audit Report
+
+## Audit Sources
+- 9 mapper agents (100% file coverage)
+- 8 specialized domain auditors (parallel)
+- 1 cross-cutting deep audit (parallel)
+- Total source files: 136 (excluding 27 test files)
+
+---
+
+## CRITICAL — Will crash or lose data
+
+## BUG — Incorrect behavior
+
+## SILENT FAILURE — Error swallowed or ignored
+
+## RACE CONDITION — Concurrency issue
+
+## LOGIC ERROR — Code doesn't match intent
+
+## PERFORMANCE — Unnecessary cost
+
+## SECURITY — Vulnerability or exposure
+
+## AUTHORIZATION — Access control gap
+
+## DATA INTEGRITY — GORM / database issue
+
+## API CONTRACT — Request/response issue
+
+## ARCHITECTURE — Layer or pattern violation
+
+## FRAGILE — Works now but will break easily
+
+---
+
+## Summary