Harden API security: input validation, safe auth extraction, new tests, and deploy config

Comprehensive security hardening from audit findings:
- Add validation tags to all DTO request structs (max lengths, ranges, enums)
- Replace unsafe type assertions with MustGetAuthUser helper across all handlers
- Remove query-param token auth from admin middleware (prevents URL token leakage)
- Add request validation calls in handlers that were missing c.Validate()
- Remove goroutines in handlers (timezone update now synchronous)
- Add sanitize middleware and path traversal protection (path_utils)
- Stop resetting admin passwords on migration restart
- Warn on well-known default SECRET_KEY
- Add ~30 new test files covering security regressions, auth safety, repos, and services
- Add deploy/ config, audit digests, and AUDIT_FINDINGS documentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/middleware/sanitize_test.go

@@ -0,0 +1,59 @@
+package middleware
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestSanitizeSortColumn_AllowedColumn_Passes(t *testing.T) {
+	allowed := []string{"created_at", "updated_at", "name"}
+	result := SanitizeSortColumn("created_at", allowed, "created_at")
+	assert.Equal(t, "created_at", result)
+}
+
+func TestSanitizeSortColumn_CaseInsensitive(t *testing.T) {
+	allowed := []string{"created_at", "updated_at", "name"}
+	result := SanitizeSortColumn("Created_At", allowed, "created_at")
+	assert.Equal(t, "created_at", result)
+}
+
+func TestSanitizeSortColumn_SQLInjection_ReturnsDefault(t *testing.T) {
+	allowed := []string{"created_at", "updated_at", "name"}
+
+	tests := []struct {
+		name  string
+		input string
+	}{
+		{"drop table", "created_at; DROP TABLE auth_user; --"},
+		{"union select", "name UNION SELECT * FROM auth_user"},
+		{"or 1=1", "name OR 1=1"},
+		{"semicolon", "created_at;"},
+		{"subquery", "(SELECT password FROM auth_user LIMIT 1)"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := SanitizeSortColumn(tt.input, allowed, "created_at")
+			assert.Equal(t, "created_at", result, "SQL injection attempt should return default")
+		})
+	}
+}
+
+func TestSanitizeSortColumn_Empty_ReturnsDefault(t *testing.T) {
+	allowed := []string{"created_at", "updated_at", "name"}
+	result := SanitizeSortColumn("", allowed, "created_at")
+	assert.Equal(t, "created_at", result)
+}
+
+func TestSanitizeSortColumn_Whitespace_ReturnsDefault(t *testing.T) {
+	allowed := []string{"created_at", "updated_at", "name"}
+	result := SanitizeSortColumn("   ", allowed, "created_at")
+	assert.Equal(t, "created_at", result)
+}
+
+func TestSanitizeSortColumn_UnknownColumn_ReturnsDefault(t *testing.T) {
+	allowed := []string{"created_at", "updated_at", "name"}
+	result := SanitizeSortColumn("nonexistent_column", allowed, "created_at")
+	assert.Equal(t, "created_at", result)
+}