Harden API security: input validation, safe auth extraction, new tests, and deploy config

Comprehensive security hardening from audit findings:
- Add validation tags to all DTO request structs (max lengths, ranges, enums)
- Replace unsafe type assertions with MustGetAuthUser helper across all handlers
- Remove query-param token auth from admin middleware (prevents URL token leakage)
- Add request validation calls in handlers that were missing c.Validate()
- Remove goroutines in handlers (timezone update now synchronous)
- Add sanitize middleware and path traversal protection (path_utils)
- Stop resetting admin passwords on migration restart
- Warn on well-known default SECRET_KEY
- Add ~30 new test files covering security regressions, auth safety, repos, and services
- Add deploy/ config, audit digests, and AUDIT_FINDINGS documentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/config/config.go

@@ -338,10 +338,14 @@ func validate(cfg *Config) error {
 			// In debug mode, use a default key with a warning for local development
 			cfg.Security.SecretKey = "change-me-in-production-secret-key-12345"
 			fmt.Println("WARNING: SECRET_KEY not set, using default (debug mode only)")
+			fmt.Println("WARNING: *** DO NOT USE THIS DEFAULT KEY IN PRODUCTION ***")
 		} else {
 			// In production, refuse to start without a proper secret key
 			return fmt.Errorf("FATAL: SECRET_KEY environment variable is required in production (DEBUG=false)")
 		}
+	} else if cfg.Security.SecretKey == "change-me-in-production-secret-key-12345" {
+		// Warn if someone explicitly set the well-known debug key
+		fmt.Println("WARNING: SECRET_KEY is set to the well-known debug default. Change it for production use.")
 	}
 
 	// Database password might come from DATABASE_URL, don't require it separately