Harden API security: input validation, safe auth extraction, new tests, and deploy config

Comprehensive security hardening from audit findings:
- Add validation tags to all DTO request structs (max lengths, ranges, enums)
- Replace unsafe type assertions with MustGetAuthUser helper across all handlers
- Remove query-param token auth from admin middleware (prevents URL token leakage)
- Add request validation calls in handlers that were missing c.Validate()
- Remove goroutines in handlers (timezone update now synchronous)
- Add sanitize middleware and path traversal protection (path_utils)
- Stop resetting admin passwords on migration restart
- Warn on well-known default SECRET_KEY
- Add ~30 new test files covering security regressions, auth safety, repos, and services
- Add deploy/ config, audit digests, and AUDIT_FINDINGS documentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/middleware/sanitize.go

@@ -0,0 +1,19 @@
+package middleware
+
+import "strings"
+
+// SanitizeSortColumn validates a user-supplied sort column against an allowlist.
+// Returns defaultCol if the input is empty or not in the allowlist.
+// This prevents SQL injection via ORDER BY clauses.
+func SanitizeSortColumn(input string, allowedCols []string, defaultCol string) string {
+	input = strings.TrimSpace(input)
+	if input == "" {
+		return defaultCol
+	}
+	for _, col := range allowedCols {
+		if strings.EqualFold(input, col) {
+			return col
+		}
+	}
+	return defaultCol
+}