Harden API security: input validation, safe auth extraction, new tests, and deploy config

Comprehensive security hardening from audit findings:
- Add validation tags to all DTO request structs (max lengths, ranges, enums)
- Replace unsafe type assertions with MustGetAuthUser helper across all handlers
- Remove query-param token auth from admin middleware (prevents URL token leakage)
- Add request validation calls in handlers that were missing c.Validate()
- Remove goroutines in handlers (timezone update now synchronous)
- Add sanitize middleware and path traversal protection (path_utils)
- Stop resetting admin passwords on migration restart
- Warn on well-known default SECRET_KEY
- Add ~30 new test files covering security regressions, auth safety, repos, and services
- Add deploy/ config, audit digests, and AUDIT_FINDINGS documentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/monitoring/handler.go

@@ -17,8 +17,13 @@ var upgrader = websocket.Upgrader{
 	ReadBufferSize:  1024,
 	WriteBufferSize: 1024,
 	CheckOrigin: func(r *http.Request) bool {
-		// Allow connections from admin panel
-		return true
+		origin := r.Header.Get("Origin")
+		if origin == "" {
+			// Same-origin requests may omit the Origin header
+			return true
+		}
+		// Allow if origin matches the request host
+		return strings.HasPrefix(origin, "https://"+r.Host) || strings.HasPrefix(origin, "http://"+r.Host)
 	},
 }
 
@@ -116,6 +121,7 @@ func (h *Handler) WebSocket(c echo.Context) error {
 	conn, err := upgrader.Upgrade(c.Response().Writer, c.Request(), nil)
 	if err != nil {
 		log.Error().Err(err).Msg("Failed to upgrade WebSocket connection")
+		return err
 	}
 	defer conn.Close()
 
@@ -174,6 +180,7 @@ func (h *Handler) WebSocket(c echo.Context) error {
 			h.sendStats(conn, &wsMu)
 
 		case <-ctx.Done():
+			return nil
 		}
 	}
 }