Harden API security: input validation, safe auth extraction, new tests, and deploy config

Comprehensive security hardening from audit findings:
- Add validation tags to all DTO request structs (max lengths, ranges, enums)
- Replace unsafe type assertions with MustGetAuthUser helper across all handlers
- Remove query-param token auth from admin middleware (prevents URL token leakage)
- Add request validation calls in handlers that were missing c.Validate()
- Remove goroutines in handlers (timezone update now synchronous)
- Add sanitize middleware and path traversal protection (path_utils)
- Stop resetting admin passwords on migration restart
- Warn on well-known default SECRET_KEY
- Add ~30 new test files covering security regressions, auth safety, repos, and services
- Add deploy/ config, audit digests, and AUDIT_FINDINGS documentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/repositories/task_template_repo.go

@@ -45,7 +45,8 @@ func (r *TaskTemplateRepository) GetByCategory(categoryID uint) ([]models.TaskTe
 // Search searches templates by title and tags
 func (r *TaskTemplateRepository) Search(query string) ([]models.TaskTemplate, error) {
 	var templates []models.TaskTemplate
-	searchTerm := "%" + strings.ToLower(query) + "%"
+	escaped := escapeLikeWildcards(strings.ToLower(query))
+	searchTerm := "%" + escaped + "%"
 
 	err := r.db.
 		Preload("Category").
@@ -77,7 +78,7 @@ func (r *TaskTemplateRepository) Create(template *models.TaskTemplate) error {
 
 // Update updates an existing task template
 func (r *TaskTemplateRepository) Update(template *models.TaskTemplate) error {
-	return r.db.Save(template).Error
+	return r.db.Omit("Category", "Frequency").Save(template).Error
 }
 
 // Delete hard deletes a task template