Harden API security: input validation, safe auth extraction, new tests, and deploy config

Comprehensive security hardening from audit findings:
- Add validation tags to all DTO request structs (max lengths, ranges, enums)
- Replace unsafe type assertions with MustGetAuthUser helper across all handlers
- Remove query-param token auth from admin middleware (prevents URL token leakage)
- Add request validation calls in handlers that were missing c.Validate()
- Remove goroutines in handlers (timezone update now synchronous)
- Add sanitize middleware and path traversal protection (path_utils)
- Stop resetting admin passwords on migration restart
- Warn on well-known default SECRET_KEY
- Add ~30 new test files covering security regressions, auth safety, repos, and services
- Add deploy/ config, audit digests, and AUDIT_FINDINGS documentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/middleware/admin_auth.go

@@ -35,7 +35,9 @@ func AdminAuthMiddleware(cfg *config.Config, adminRepo *repositories.AdminReposi
 		return func(c echo.Context) error {
 			var tokenString string
 
-			// Get token from Authorization header
+			// Get token from Authorization header only.
+			// Query parameter authentication is intentionally not supported
+			// because tokens in URLs leak into server logs and browser history.
 			authHeader := c.Request().Header.Get("Authorization")
 			if authHeader != "" {
 				// Check Bearer prefix
@@ -45,11 +47,6 @@ func AdminAuthMiddleware(cfg *config.Config, adminRepo *repositories.AdminReposi
 				}
 			}
 
-			// If no header token, check query parameter (for WebSocket connections)
-			if tokenString == "" {
-				tokenString = c.QueryParam("token")
-			}
-
 			if tokenString == "" {
 				return c.JSON(http.StatusUnauthorized, map[string]interface{}{"error": "Authorization required"})
 			}
@@ -121,7 +118,10 @@ func RequireSuperAdmin() echo.MiddlewareFunc {
 				return c.JSON(http.StatusUnauthorized, map[string]interface{}{"error": "Admin authentication required"})
 			}
 
-			adminUser := admin.(*models.AdminUser)
+			adminUser, ok := admin.(*models.AdminUser)
+			if !ok {
+				return c.JSON(http.StatusUnauthorized, map[string]interface{}{"error": "Admin authentication required"})
+			}
 			if !adminUser.IsSuperAdmin() {
 				return c.JSON(http.StatusForbidden, map[string]interface{}{"error": "Super admin privileges required"})
 			}