Harden API security: input validation, safe auth extraction, new tests, and deploy config

Comprehensive security hardening from audit findings:
- Add validation tags to all DTO request structs (max lengths, ranges, enums)
- Replace unsafe type assertions with MustGetAuthUser helper across all handlers
- Remove query-param token auth from admin middleware (prevents URL token leakage)
- Add request validation calls in handlers that were missing c.Validate()
- Remove goroutines in handlers (timezone update now synchronous)
- Add sanitize middleware and path traversal protection (path_utils)
- Stop resetting admin passwords on migration restart
- Warn on well-known default SECRET_KEY
- Add ~30 new test files covering security regressions, auth safety, repos, and services
- Add deploy/ config, audit digests, and AUDIT_FINDINGS documentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/middleware/request_id.go

@@ -1,10 +1,15 @@
 package middleware
 
 import (
+	"regexp"
+
 	"github.com/google/uuid"
 	"github.com/labstack/echo/v4"
 )
 
+// validRequestID matches alphanumeric characters and hyphens, 1-64 chars.
+var validRequestID = regexp.MustCompile(`^[a-zA-Z0-9\-]{1,64}$`)
+
 const (
 	// HeaderXRequestID is the header key for request correlation IDs
 	HeaderXRequestID = "X-Request-ID"
@@ -17,9 +22,11 @@ const (
 func RequestIDMiddleware() echo.MiddlewareFunc {
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(c echo.Context) error {
-			// Use existing request ID from header if present, otherwise generate one
+			// Use existing request ID from header if present and valid, otherwise generate one.
+			// Sanitize to alphanumeric + hyphens only (max 64 chars) to prevent
+			// log injection via control characters or overly long values.
 			reqID := c.Request().Header.Get(HeaderXRequestID)
-			if reqID == "" {
+			if reqID == "" || !validRequestID.MatchString(reqID) {
 				reqID = uuid.New().String()
 			}