Harden API security: input validation, safe auth extraction, new tests, and deploy config

Comprehensive security hardening from audit findings:
- Add validation tags to all DTO request structs (max lengths, ranges, enums)
- Replace unsafe type assertions with MustGetAuthUser helper across all handlers
- Remove query-param token auth from admin middleware (prevents URL token leakage)
- Add request validation calls in handlers that were missing c.Validate()
- Remove goroutines in handlers (timezone update now synchronous)
- Add sanitize middleware and path traversal protection (path_utils)
- Stop resetting admin passwords on migration restart
- Warn on well-known default SECRET_KEY
- Add ~30 new test files covering security regressions, auth safety, repos, and services
- Add deploy/ config, audit digests, and AUDIT_FINDINGS documentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/repositories/residence_repo.go

@@ -6,6 +6,7 @@ import (
 	"math/big"
 	"time"
 
+	"github.com/rs/zerolog/log"
 	"gorm.io/gorm"
 
 	"github.com/treytartt/casera-api/internal/models"
@@ -269,7 +270,9 @@ func (r *ResidenceRepository) GetActiveShareCode(residenceID uint) (*models.Resi
 	// Check if expired
 	if shareCode.ExpiresAt != nil && time.Now().UTC().After(*shareCode.ExpiresAt) {
 		// Auto-deactivate expired code
-		r.DeactivateShareCode(shareCode.ID)
+		if err := r.DeactivateShareCode(shareCode.ID); err != nil {
+			log.Error().Err(err).Uint("code_id", shareCode.ID).Msg("Failed to deactivate expired share code")
+		}
 		return nil, nil
 	}
 
@@ -296,9 +299,11 @@ func (r *ResidenceRepository) generateUniqueCode() (string, error) {
 
 		// Check if code already exists
 		var count int64
-		r.db.Model(&models.ResidenceShareCode{}).
+		if err := r.db.Model(&models.ResidenceShareCode{}).
 			Where("code = ? AND is_active = ?", codeStr, true).
-			Count(&count)
+			Count(&count).Error; err != nil {
+			return "", err
+		}
 
 		if count == 0 {
 			return codeStr, nil