Harden API security: input validation, safe auth extraction, new tests, and deploy config

Comprehensive security hardening from audit findings:
- Add validation tags to all DTO request structs (max lengths, ranges, enums)
- Replace unsafe type assertions with MustGetAuthUser helper across all handlers
- Remove query-param token auth from admin middleware (prevents URL token leakage)
- Add request validation calls in handlers that were missing c.Validate()
- Remove goroutines in handlers (timezone update now synchronous)
- Add sanitize middleware and path traversal protection (path_utils)
- Stop resetting admin passwords on migration restart
- Warn on well-known default SECRET_KEY
- Add ~30 new test files covering security regressions, auth safety, repos, and services
- Add deploy/ config, audit digests, and AUDIT_FINDINGS documentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/handlers/user_handler.go

@@ -8,7 +8,6 @@ import (
 
 	"github.com/treytartt/casera-api/internal/apperrors"
 	"github.com/treytartt/casera-api/internal/middleware"
-	"github.com/treytartt/casera-api/internal/models"
 	"github.com/treytartt/casera-api/internal/services"
 )
 
@@ -26,7 +25,10 @@ func NewUserHandler(userService *services.UserService) *UserHandler {
 
 // ListUsers handles GET /api/users/
 func (h *UserHandler) ListUsers(c echo.Context) error {
-	user := c.Get(middleware.AuthUserKey).(*models.User)
+	user, err := middleware.MustGetAuthUser(c)
+	if err != nil {
+		return err
+	}
 
 	// Only allow listing users that share residences with the current user
 	users, err := h.userService.ListUsersInSharedResidences(user.ID)
@@ -42,7 +44,10 @@ func (h *UserHandler) ListUsers(c echo.Context) error {
 
 // GetUser handles GET /api/users/:id/
 func (h *UserHandler) GetUser(c echo.Context) error {
-	user := c.Get(middleware.AuthUserKey).(*models.User)
+	user, err := middleware.MustGetAuthUser(c)
+	if err != nil {
+		return err
+	}
 
 	userID, err := strconv.ParseUint(c.Param("id"), 10, 32)
 	if err != nil {
@@ -60,7 +65,10 @@ func (h *UserHandler) GetUser(c echo.Context) error {
 
 // ListProfiles handles GET /api/users/profiles/
 func (h *UserHandler) ListProfiles(c echo.Context) error {
-	user := c.Get(middleware.AuthUserKey).(*models.User)
+	user, err := middleware.MustGetAuthUser(c)
+	if err != nil {
+		return err
+	}
 
 	// List profiles of users in shared residences
 	profiles, err := h.userService.ListProfilesInSharedResidences(user.ID)