Harden API security: input validation, safe auth extraction, new tests, and deploy config

Comprehensive security hardening from audit findings:
- Add validation tags to all DTO request structs (max lengths, ranges, enums)
- Replace unsafe type assertions with MustGetAuthUser helper across all handlers
- Remove query-param token auth from admin middleware (prevents URL token leakage)
- Add request validation calls in handlers that were missing c.Validate()
- Remove goroutines in handlers (timezone update now synchronous)
- Add sanitize middleware and path traversal protection (path_utils)
- Stop resetting admin passwords on migration restart
- Warn on well-known default SECRET_KEY
- Add ~30 new test files covering security regressions, auth safety, repos, and services
- Add deploy/ config, audit digests, and AUDIT_FINDINGS documentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/repositories/document_repo_test.go

@@ -0,0 +1,38 @@
+package repositories
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/treytartt/casera-api/internal/models"
+	"github.com/treytartt/casera-api/internal/testutil"
+)
+
+func TestDocumentRepository_FindByUser_HasDefaultLimit(t *testing.T) {
+	db := testutil.SetupTestDB(t)
+	repo := NewDocumentRepository(db)
+
+	user := testutil.CreateTestUser(t, db, "owner", "owner@test.com", "password")
+	residence := testutil.CreateTestResidence(t, db, user.ID, "Test House")
+
+	// Create 510 documents to exceed the default limit of 500
+	for i := 0; i < 510; i++ {
+		doc := &models.Document{
+			ResidenceID:  residence.ID,
+			CreatedByID:  user.ID,
+			Title:        fmt.Sprintf("Doc %d", i+1),
+			DocumentType: models.DocumentTypeGeneral,
+			FileURL:      "https://example.com/doc.pdf",
+			IsActive:     true,
+		}
+		err := db.Create(doc).Error
+		require.NoError(t, err)
+	}
+
+	docs, err := repo.FindByUser([]uint{residence.ID})
+	require.NoError(t, err)
+	assert.Equal(t, 500, len(docs), "FindByUser should return at most 500 documents by default")
+}