Harden API security: input validation, safe auth extraction, new tests, and deploy config

Comprehensive security hardening from audit findings:
- Add validation tags to all DTO request structs (max lengths, ranges, enums)
- Replace unsafe type assertions with MustGetAuthUser helper across all handlers
- Remove query-param token auth from admin middleware (prevents URL token leakage)
- Add request validation calls in handlers that were missing c.Validate()
- Remove goroutines in handlers (timezone update now synchronous)
- Add sanitize middleware and path traversal protection (path_utils)
- Stop resetting admin passwords on migration restart
- Warn on well-known default SECRET_KEY
- Add ~30 new test files covering security regressions, auth safety, repos, and services
- Add deploy/ config, audit digests, and AUDIT_FINDINGS documentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/monitoring/writer.go

@@ -8,23 +8,56 @@ import (
 	"github.com/google/uuid"
 )
 
-// RedisLogWriter implements io.Writer to capture zerolog output to Redis
+const (
+	// writerChannelSize is the buffer size for the async log write channel.
+	// Entries beyond this limit are dropped to prevent unbounded memory growth.
+	writerChannelSize = 256
+)
+
+// RedisLogWriter implements io.Writer to capture zerolog output to Redis.
+// It uses a single background goroutine with a buffered channel instead of
+// spawning a new goroutine per log line, preventing unbounded goroutine growth.
 type RedisLogWriter struct {
 	buffer  *LogBuffer
 	process string
 	enabled atomic.Bool
+	ch      chan LogEntry
+	done    chan struct{}
 }
 
-// NewRedisLogWriter creates a new writer that captures logs to Redis
+// NewRedisLogWriter creates a new writer that captures logs to Redis.
+// It starts a single background goroutine that drains the buffered channel.
 func NewRedisLogWriter(buffer *LogBuffer, process string) *RedisLogWriter {
 	w := &RedisLogWriter{
 		buffer:  buffer,
 		process: process,
+		ch:      make(chan LogEntry, writerChannelSize),
+		done:    make(chan struct{}),
 	}
 	w.enabled.Store(true) // enabled by default
+
+	// Single background goroutine drains the channel
+	go w.drainLoop()
+
 	return w
 }
 
+// drainLoop reads entries from the buffered channel and pushes them to Redis.
+// It runs in a single goroutine for the lifetime of the writer.
+func (w *RedisLogWriter) drainLoop() {
+	defer close(w.done)
+	for entry := range w.ch {
+		_ = w.buffer.Push(entry) // Ignore errors to avoid blocking log output
+	}
+}
+
+// Close shuts down the background goroutine. It should be called during
+// graceful shutdown to ensure all buffered entries are flushed.
+func (w *RedisLogWriter) Close() {
+	close(w.ch)
+	<-w.done // Wait for drain to finish
+}
+
 // SetEnabled enables or disables log capture to Redis
 func (w *RedisLogWriter) SetEnabled(enabled bool) {
 	w.enabled.Store(enabled)
@@ -35,8 +68,10 @@ func (w *RedisLogWriter) IsEnabled() bool {
 	return w.enabled.Load()
 }
 
-// Write implements io.Writer interface
-// It parses zerolog JSON output and writes to Redis asynchronously
+// Write implements io.Writer interface.
+// It parses zerolog JSON output and sends it to the buffered channel for
+// async Redis writes. If the channel is full, the entry is dropped to
+// avoid blocking the caller (back-pressure shedding).
 func (w *RedisLogWriter) Write(p []byte) (n int, err error) {
 	// Skip if monitoring is disabled
 	if !w.enabled.Load() {
@@ -86,10 +121,14 @@ func (w *RedisLogWriter) Write(p []byte) (n int, err error) {
 		}
 	}
 
-	// Write to Redis asynchronously to avoid blocking
-	go func() {
-		_ = w.buffer.Push(entry) // Ignore errors to avoid blocking log output
-	}()
+	// Non-blocking send: drop entries if channel is full rather than
+	// spawning unbounded goroutines or blocking the logger
+	select {
+	case w.ch <- entry:
+		// Sent successfully
+	default:
+		// Channel full — drop this entry to avoid back-pressure on the logger
+	}
 
 	return len(p), nil
 }