Harden API security: input validation, safe auth extraction, new tests, and deploy config

Comprehensive security hardening from audit findings:
- Add validation tags to all DTO request structs (max lengths, ranges, enums)
- Replace unsafe type assertions with MustGetAuthUser helper across all handlers
- Remove query-param token auth from admin middleware (prevents URL token leakage)
- Add request validation calls in handlers that were missing c.Validate()
- Remove goroutines in handlers (timezone update now synchronous)
- Add sanitize middleware and path traversal protection (path_utils)
- Stop resetting admin passwords on migration restart
- Warn on well-known default SECRET_KEY
- Add ~30 new test files covering security regressions, auth safety, repos, and services
- Add deploy/ config, audit digests, and AUDIT_FINDINGS documentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/services/pdf_service.go

@@ -126,10 +126,11 @@ func (s *PDFService) GenerateTasksReportPDF(report *TasksReportResponse) ([]byte
 				pdf.SetFillColor(255, 255, 255) // White
 			}
 
-			// Title (truncate if too long)
+			// Title (truncate if too long, use runes to avoid cutting multi-byte UTF-8 characters)
 			title := task.Title
-			if len(title) > 35 {
-				title = title[:32] + "..."
+			titleRunes := []rune(title)
+			if len(titleRunes) > 35 {
+				title = string(titleRunes[:32]) + "..."
 			}
 
 			// Status text