Production hardening: security, resilience, observability, and compliance

Password complexity: custom validator requiring uppercase, lowercase, digit (min 8 chars)
Token expiry: 90-day token lifetime with refresh endpoint (60-90 day renewal window)
Health check: /api/health/ now pings Postgres + Redis, returns 503 on failure
Audit logging: async audit_log table for auth events (login, register, delete, etc.)
Circuit breaker: APNs/FCM push sends wrapped with 5-failure threshold, 30s recovery
FK indexes: 27 missing foreign key indexes across all tables (migration 017)
CSP header: default-src 'none'; frame-ancestors 'none'
Gzip compression: level 5 with media endpoint skipper
Prometheus metrics: /metrics endpoint using existing monitoring service
External timeouts: 15s push, 30s SMTP, context timeouts on all external calls

Migrations: 016 (token created_at), 017 (FK indexes), 018 (audit_log)
Tests: circuit breaker (15), audit service (8), token refresh (7), health (4),
       middleware expiry (5), validator (new)

internal/config/config.go

@@ -134,6 +134,8 @@ type SecurityConfig struct {
 	PasswordResetExpiry  time.Duration
 	ConfirmationExpiry   time.Duration
 	MaxPasswordResetRate int // per hour
+	TokenExpiryDays      int // Number of days before auth tokens expire (default 90)
+	TokenRefreshDays     int // Token must be at least this many days old before refresh (default 60)
 }
 
 // StorageConfig holds file storage settings
@@ -262,6 +264,8 @@ func Load() (*Config, error) {
 				PasswordResetExpiry:  15 * time.Minute,
 				ConfirmationExpiry:   24 * time.Hour,
 				MaxPasswordResetRate: 3,
+				TokenExpiryDays:      viper.GetInt("TOKEN_EXPIRY_DAYS"),
+				TokenRefreshDays:     viper.GetInt("TOKEN_REFRESH_DAYS"),
 			},
 			Storage: StorageConfig{
 				UploadDir:     viper.GetString("STORAGE_UPLOAD_DIR"),
@@ -369,6 +373,10 @@ func setDefaults() {
 	viper.SetDefault("OVERDUE_REMINDER_HOUR", 15) // 9:00 AM UTC
 	viper.SetDefault("DAILY_DIGEST_HOUR", 3)      // 3:00 AM UTC
 
+	// Token expiry defaults
+	viper.SetDefault("TOKEN_EXPIRY_DAYS", 90)  // Tokens expire after 90 days
+	viper.SetDefault("TOKEN_REFRESH_DAYS", 60) // Tokens can be refreshed after 60 days
+
 	// Storage defaults
 	viper.SetDefault("STORAGE_UPLOAD_DIR", "./uploads")
 	viper.SetDefault("STORAGE_BASE_URL", "/uploads")