Harden API security: input validation, safe auth extraction, new tests, and deploy config

Comprehensive security hardening from audit findings:
- Add validation tags to all DTO request structs (max lengths, ranges, enums)
- Replace unsafe type assertions with MustGetAuthUser helper across all handlers
- Remove query-param token auth from admin middleware (prevents URL token leakage)
- Add request validation calls in handlers that were missing c.Validate()
- Remove goroutines in handlers (timezone update now synchronous)
- Add sanitize middleware and path traversal protection (path_utils)
- Stop resetting admin passwords on migration restart
- Warn on well-known default SECRET_KEY
- Add ~30 new test files covering security regressions, auth safety, repos, and services
- Add deploy/ config, audit digests, and AUDIT_FINDINGS documentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/middleware/auth.go

@@ -63,7 +63,7 @@ func (m *AuthMiddleware) TokenAuth() echo.MiddlewareFunc {
 			// Cache miss - look up token in database
 			user, err = m.getUserFromDatabase(token)
 			if err != nil {
-				log.Debug().Err(err).Str("token", token[:8]+"...").Msg("Token authentication failed")
+				log.Debug().Err(err).Str("token", truncateToken(token)).Msg("Token authentication failed")
 				return apperrors.Unauthorized("error.invalid_token")
 			}
 
@@ -200,13 +200,18 @@ func (m *AuthMiddleware) InvalidateToken(ctx context.Context, token string) erro
 	return m.cache.InvalidateAuthToken(ctx, token)
 }
 
-// GetAuthUser retrieves the authenticated user from the Echo context
+// GetAuthUser retrieves the authenticated user from the Echo context.
+// Returns nil if the context value is missing or not of the expected type.
 func GetAuthUser(c echo.Context) *models.User {
-	user := c.Get(AuthUserKey)
-	if user == nil {
+	val := c.Get(AuthUserKey)
+	if val == nil {
 		return nil
 	}
-	return user.(*models.User)
+	user, ok := val.(*models.User)
+	if !ok {
+		return nil
+	}
+	return user
 }
 
 // GetAuthToken retrieves the auth token from the Echo context
@@ -226,3 +231,12 @@ func MustGetAuthUser(c echo.Context) (*models.User, error) {
 	}
 	return user, nil
 }
+
+// truncateToken safely truncates a token string for logging.
+// Returns at most the first 8 characters followed by "...".
+func truncateToken(token string) string {
+	if len(token) > 8 {
+		return token[:8] + "..."
+	}
+	return token + "..."
+}