Harden API security: input validation, safe auth extraction, new tests, and deploy config

Comprehensive security hardening from audit findings:
- Add validation tags to all DTO request structs (max lengths, ranges, enums)
- Replace unsafe type assertions with MustGetAuthUser helper across all handlers
- Remove query-param token auth from admin middleware (prevents URL token leakage)
- Add request validation calls in handlers that were missing c.Validate()
- Remove goroutines in handlers (timezone update now synchronous)
- Add sanitize middleware and path traversal protection (path_utils)
- Stop resetting admin passwords on migration restart
- Warn on well-known default SECRET_KEY
- Add ~30 new test files covering security regressions, auth safety, repos, and services
- Add deploy/ config, audit digests, and AUDIT_FINDINGS documentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/services/contractor_service.go

@@ -195,6 +195,18 @@ func (s *ContractorService) UpdateContractor(contractorID, userID uint, req *req
 	if req.IsFavorite != nil {
 		contractor.IsFavorite = *req.IsFavorite
 	}
+	// If residence_id is provided, verify the user has access to the NEW residence.
+	// This prevents an attacker from reassigning a contractor to someone else's residence.
+	if req.ResidenceID != nil {
+		hasAccess, err := s.residenceRepo.HasAccess(*req.ResidenceID, userID)
+		if err != nil {
+			return nil, apperrors.Internal(err)
+		}
+		if !hasAccess {
+			return nil, apperrors.Forbidden("error.residence_access_denied")
+		}
+	}
+
 	// If residence_id is not sent in the request (nil), it means the user
 	// removed the residence association - contractor becomes personal
 	contractor.ResidenceID = req.ResidenceID