Harden API security: input validation, safe auth extraction, new tests, and deploy config

Comprehensive security hardening from audit findings:
- Add validation tags to all DTO request structs (max lengths, ranges, enums)
- Replace unsafe type assertions with MustGetAuthUser helper across all handlers
- Remove query-param token auth from admin middleware (prevents URL token leakage)
- Add request validation calls in handlers that were missing c.Validate()
- Remove goroutines in handlers (timezone update now synchronous)
- Add sanitize middleware and path traversal protection (path_utils)
- Stop resetting admin passwords on migration restart
- Warn on well-known default SECRET_KEY
- Add ~30 new test files covering security regressions, auth safety, repos, and services
- Add deploy/ config, audit digests, and AUDIT_FINDINGS documentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/handlers/upload_handler.go

@@ -4,8 +4,11 @@ import (
 	"net/http"
 
 	"github.com/labstack/echo/v4"
+	"github.com/rs/zerolog/log"
 
 	"github.com/treytartt/casera-api/internal/apperrors"
+	"github.com/treytartt/casera-api/internal/middleware"
+	"github.com/treytartt/casera-api/internal/models"
 	"github.com/treytartt/casera-api/internal/services"
 )
 
@@ -73,17 +76,38 @@ func (h *UploadHandler) UploadCompletion(c echo.Context) error {
 	return c.JSON(http.StatusOK, result)
 }
 
+// DeleteFileRequest is the request body for deleting a file.
+type DeleteFileRequest struct {
+	URL string `json:"url" validate:"required"`
+}
+
 // DeleteFile handles DELETE /api/uploads
-// Expects JSON body with "url" field
+// Expects JSON body with "url" field.
+//
+// TODO(SEC-18): Add ownership verification. Currently any authenticated user can delete
+// any file if they know the URL. The upload system does not track which user uploaded
+// which file, so a proper fix requires adding an uploads table or file ownership metadata.
+// For now, deletions are logged with user ID for audit trail, and StorageService.Delete
+// enforces path containment to prevent deleting files outside the upload directory.
 func (h *UploadHandler) DeleteFile(c echo.Context) error {
-	var req struct {
-		URL string `json:"url" binding:"required"`
-	}
+	var req DeleteFileRequest
 
 	if err := c.Bind(&req); err != nil {
 		return apperrors.BadRequest("error.invalid_request")
 	}
 
+	if err := c.Validate(&req); err != nil {
+		return apperrors.BadRequest("error.url_required")
+	}
+
+	// Log the deletion with user ID for audit trail
+	if user, ok := c.Get(middleware.AuthUserKey).(*models.User); ok {
+		log.Info().
+			Uint("user_id", user.ID).
+			Str("file_url", req.URL).
+			Msg("File deletion requested")
+	}
+
 	if err := h.storageService.Delete(req.URL); err != nil {
 		return err
 	}