Harden API security: input validation, safe auth extraction, new tests, and deploy config

Comprehensive security hardening from audit findings:
- Add validation tags to all DTO request structs (max lengths, ranges, enums)
- Replace unsafe type assertions with MustGetAuthUser helper across all handlers
- Remove query-param token auth from admin middleware (prevents URL token leakage)
- Add request validation calls in handlers that were missing c.Validate()
- Remove goroutines in handlers (timezone update now synchronous)
- Add sanitize middleware and path traversal protection (path_utils)
- Stop resetting admin passwords on migration restart
- Warn on well-known default SECRET_KEY
- Add ~30 new test files covering security regressions, auth safety, repos, and services
- Add deploy/ config, audit digests, and AUDIT_FINDINGS documentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/router/router.go

@@ -129,6 +129,7 @@ func SetupRouter(deps *Dependencies) *echo.Echo {
 	taskService.SetResidenceService(residenceService) // For including TotalSummary in CRUD responses
 	taskService.SetStorageService(deps.StorageService) // For reading completion images for email
 	subscriptionService := services.NewSubscriptionService(subscriptionRepo, residenceRepo, taskRepo, contractorRepo, documentRepo)
+	residenceService.SetSubscriptionService(subscriptionService) // Wire up subscription service for tier limit enforcement
 	taskTemplateService := services.NewTaskTemplateService(taskTemplateRepo)
 
 	// Initialize webhook event repo for deduplication