Harden API security: input validation, safe auth extraction, new tests, and deploy config

Comprehensive security hardening from audit findings:
- Add validation tags to all DTO request structs (max lengths, ranges, enums)
- Replace unsafe type assertions with MustGetAuthUser helper across all handlers
- Remove query-param token auth from admin middleware (prevents URL token leakage)
- Add request validation calls in handlers that were missing c.Validate()
- Remove goroutines in handlers (timezone update now synchronous)
- Add sanitize middleware and path traversal protection (path_utils)
- Stop resetting admin passwords on migration restart
- Warn on well-known default SECRET_KEY
- Add ~30 new test files covering security regressions, auth safety, repos, and services
- Add deploy/ config, audit digests, and AUDIT_FINDINGS documentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/handlers/residence_handler_test.go

@@ -525,3 +525,45 @@ func TestResidenceHandler_JSONResponses(t *testing.T) {
 		assert.IsType(t, []map[string]interface{}{}, response)
 	})
 }
+
+func TestResidenceHandler_CreateResidence_NegativeBedrooms_Returns400(t *testing.T) {
+	handler, e, db := setupResidenceHandler(t)
+	user := testutil.CreateTestUser(t, db, "owner", "owner@test.com", "password")
+
+	authGroup := e.Group("/api/residences")
+	authGroup.Use(testutil.MockAuthMiddleware(user))
+	authGroup.POST("/", handler.CreateResidence)
+
+	t.Run("negative bedrooms rejected", func(t *testing.T) {
+		bedrooms := -1
+		req := requests.CreateResidenceRequest{
+			Name:     "Bad House",
+			Bedrooms: &bedrooms,
+		}
+
+		w := testutil.MakeRequest(e, "POST", "/api/residences/", req, "test-token")
+		testutil.AssertStatusCode(t, w, http.StatusBadRequest)
+	})
+
+	t.Run("negative square footage rejected", func(t *testing.T) {
+		sqft := -100
+		req := requests.CreateResidenceRequest{
+			Name:          "Bad House",
+			SquareFootage: &sqft,
+		}
+
+		w := testutil.MakeRequest(e, "POST", "/api/residences/", req, "test-token")
+		testutil.AssertStatusCode(t, w, http.StatusBadRequest)
+	})
+
+	t.Run("zero bedrooms accepted", func(t *testing.T) {
+		bedrooms := 0
+		req := requests.CreateResidenceRequest{
+			Name:     "Studio Apartment",
+			Bedrooms: &bedrooms,
+		}
+
+		w := testutil.MakeRequest(e, "POST", "/api/residences/", req, "test-token")
+		testutil.AssertStatusCode(t, w, http.StatusCreated)
+	})
+}