Harden API security: input validation, safe auth extraction, new tests, and deploy config

Comprehensive security hardening from audit findings:
- Add validation tags to all DTO request structs (max lengths, ranges, enums)
- Replace unsafe type assertions with MustGetAuthUser helper across all handlers
- Remove query-param token auth from admin middleware (prevents URL token leakage)
- Add request validation calls in handlers that were missing c.Validate()
- Remove goroutines in handlers (timezone update now synchronous)
- Add sanitize middleware and path traversal protection (path_utils)
- Stop resetting admin passwords on migration restart
- Warn on well-known default SECRET_KEY
- Add ~30 new test files covering security regressions, auth safety, repos, and services
- Add deploy/ config, audit digests, and AUDIT_FINDINGS documentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/handlers/subscription_webhook_handler_test.go

@@ -0,0 +1,56 @@
+package handlers
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/labstack/echo/v4"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestVerifyGooglePubSubToken_MissingAuth_ReturnsFalse(t *testing.T) {
+	handler := &SubscriptionWebhookHandler{enabled: true}
+
+	e := echo.New()
+	// Request with no Authorization header
+	req := httptest.NewRequest(http.MethodPost, "/api/subscription/webhook/google/", nil)
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+
+	result := handler.VerifyGooglePubSubToken(c)
+	assert.False(t, result, "VerifyGooglePubSubToken should return false when Authorization header is missing")
+}
+
+func TestVerifyGooglePubSubToken_InvalidToken_ReturnsFalse(t *testing.T) {
+	handler := &SubscriptionWebhookHandler{enabled: true}
+
+	e := echo.New()
+	req := httptest.NewRequest(http.MethodPost, "/api/subscription/webhook/google/", nil)
+	req.Header.Set("Authorization", "Bearer invalid-garbage-token")
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+
+	result := handler.VerifyGooglePubSubToken(c)
+	assert.False(t, result, "VerifyGooglePubSubToken should return false for an invalid/unverifiable token")
+}
+
+func TestDecodeAppleSignedPayload_InvalidJWS_ReturnsError(t *testing.T) {
+	handler := &SubscriptionWebhookHandler{enabled: true}
+
+	// No signature parts
+	_, err := handler.decodeAppleSignedPayload("not-a-jws")
+	assert.Error(t, err, "should reject payload that is not valid JWS format")
+}
+
+func TestDecodeAppleSignedPayload_VerificationFails_ReturnsError(t *testing.T) {
+	handler := &SubscriptionWebhookHandler{enabled: true}
+
+	// Construct a JWS-shaped string with 3 parts but no valid signature.
+	// The handler should now attempt verification and fail.
+	// header.payload.signature -- all base64url garbage
+	fakeJWS := "eyJhbGciOiJFUzI1NiJ9.eyJ0ZXN0IjoidHJ1ZSJ9.invalidsig"
+
+	_, err := handler.decodeAppleSignedPayload(fakeJWS)
+	assert.Error(t, err, "should return error when Apple signature verification fails")
+}