Harden API security: input validation, safe auth extraction, new tests, and deploy config

Comprehensive security hardening from audit findings:
- Add validation tags to all DTO request structs (max lengths, ranges, enums)
- Replace unsafe type assertions with MustGetAuthUser helper across all handlers
- Remove query-param token auth from admin middleware (prevents URL token leakage)
- Add request validation calls in handlers that were missing c.Validate()
- Remove goroutines in handlers (timezone update now synchronous)
- Add sanitize middleware and path traversal protection (path_utils)
- Stop resetting admin passwords on migration restart
- Warn on well-known default SECRET_KEY
- Add ~30 new test files covering security regressions, auth safety, repos, and services
- Add deploy/ config, audit digests, and AUDIT_FINDINGS documentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/middleware/timezone.go

@@ -79,22 +79,30 @@ func parseTimezone(tz string) *time.Location {
 }
 
 // GetUserTimezone retrieves the user's timezone from the Echo context.
-// Returns UTC if not set.
+// Returns UTC if not set or if the stored value is not a *time.Location.
 func GetUserTimezone(c echo.Context) *time.Location {
-	loc := c.Get(TimezoneKey)
-	if loc == nil {
+	val := c.Get(TimezoneKey)
+	if val == nil {
 		return time.UTC
 	}
-	return loc.(*time.Location)
+	loc, ok := val.(*time.Location)
+	if !ok {
+		return time.UTC
+	}
+	return loc
 }
 
 // GetUserNow retrieves the timezone-aware "now" time from the Echo context.
 // This represents the start of the current day in the user's timezone.
-// Returns time.Now().UTC() if not set.
+// Returns time.Now().UTC() if not set or if the stored value is not a time.Time.
 func GetUserNow(c echo.Context) time.Time {
-	now := c.Get(UserNowKey)
-	if now == nil {
+	val := c.Get(UserNowKey)
+	if val == nil {
 		return time.Now().UTC()
 	}
-	return now.(time.Time)
+	now, ok := val.(time.Time)
+	if !ok {
+		return time.Now().UTC()
+	}
+	return now
 }