Harden API security: input validation, safe auth extraction, new tests, and deploy config

Comprehensive security hardening from audit findings:
- Add validation tags to all DTO request structs (max lengths, ranges, enums)
- Replace unsafe type assertions with MustGetAuthUser helper across all handlers
- Remove query-param token auth from admin middleware (prevents URL token leakage)
- Add request validation calls in handlers that were missing c.Validate()
- Remove goroutines in handlers (timezone update now synchronous)
- Add sanitize middleware and path traversal protection (path_utils)
- Stop resetting admin passwords on migration restart
- Warn on well-known default SECRET_KEY
- Add ~30 new test files covering security regressions, auth safety, repos, and services
- Add deploy/ config, audit digests, and AUDIT_FINDINGS documentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/services/path_utils_test.go

@@ -0,0 +1,55 @@
+package services
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSafeResolvePath_Normal_Resolves(t *testing.T) {
+	result, err := SafeResolvePath("/var/uploads", "images/photo.jpg")
+	require.NoError(t, err)
+	assert.Equal(t, "/var/uploads/images/photo.jpg", result)
+}
+
+func TestSafeResolvePath_SubdirPath_Resolves(t *testing.T) {
+	result, err := SafeResolvePath("/var/uploads", "documents/2024/report.pdf")
+	require.NoError(t, err)
+	assert.Equal(t, "/var/uploads/documents/2024/report.pdf", result)
+}
+
+func TestSafeResolvePath_DotDotTraversal_Blocked(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+	}{
+		{"simple dotdot", "../etc/passwd"},
+		{"nested dotdot", "../../etc/shadow"},
+		{"embedded dotdot", "images/../../etc/passwd"},
+		{"deep dotdot", "a/b/c/../../../../etc/passwd"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := SafeResolvePath("/var/uploads", tt.input)
+			assert.Error(t, err, "path traversal should be blocked: %s", tt.input)
+		})
+	}
+}
+
+func TestSafeResolvePath_AbsolutePath_Blocked(t *testing.T) {
+	_, err := SafeResolvePath("/var/uploads", "/etc/passwd")
+	assert.Error(t, err, "absolute paths should be blocked")
+}
+
+func TestSafeResolvePath_EmptyPath_Blocked(t *testing.T) {
+	_, err := SafeResolvePath("/var/uploads", "")
+	assert.Error(t, err, "empty paths should be blocked")
+}
+
+func TestSafeResolvePath_CurrentDir_Blocked(t *testing.T) {
+	// "." resolves to the base dir itself — this is not a file, so block it
+	_, err := SafeResolvePath("/var/uploads", ".")
+	assert.Error(t, err, "bare current directory should be blocked")
+}