Harden API security: input validation, safe auth extraction, new tests, and deploy config

Comprehensive security hardening from audit findings:
- Add validation tags to all DTO request structs (max lengths, ranges, enums)
- Replace unsafe type assertions with MustGetAuthUser helper across all handlers
- Remove query-param token auth from admin middleware (prevents URL token leakage)
- Add request validation calls in handlers that were missing c.Validate()
- Remove goroutines in handlers (timezone update now synchronous)
- Add sanitize middleware and path traversal protection (path_utils)
- Stop resetting admin passwords on migration restart
- Warn on well-known default SECRET_KEY
- Add ~30 new test files covering security regressions, auth safety, repos, and services
- Add deploy/ config, audit digests, and AUDIT_FINDINGS documentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/admin/handlers/completion_image_handler.go

@@ -78,11 +78,10 @@ func (h *AdminCompletionImageHandler) List(c echo.Context) error {
 	// Get total count
 	query.Count(&total)
 
-	// Apply sorting
-	sortBy := "created_at"
-	if filters.SortBy != "" {
-		sortBy = filters.SortBy
-	}
+	// Apply sorting (allowlist prevents SQL injection via sort_by parameter)
+	sortBy := filters.GetSafeSortBy([]string{
+		"id", "completion_id", "created_at", "updated_at",
+	}, "created_at")
 	query = query.Order(sortBy + " " + filters.GetSortDir())
 
 	// Apply pagination