fix(security): close High/Critical findings from the Stage 8 scan

- Bump github.com/rabbitmq/amqp091-go 1.12.0 -> 1.13.0 (3 Critical, 7 High,
  reachable via rabbitmq.Connect) and golang.org/x/{text,net,crypto},
  klauspost/compress; toolchain go1.26.8, builder image pinned to
  golang:1.26.8-alpine3.24.
- Build Content-Disposition per RFC 6266/8187 (ASCII fallback +
  filename*=UTF-8''), stripping CR/LF, quotes and backslashes (CWE-113).
- Cap request bodies with MaxBytesReader (HTTP_MAX_UPLOAD_BYTES, default
  2 GiB); multipart uploads over the limit return 413 (CWE-400).
- /readyz reports "unavailable" instead of raw backend errors (CWE-209).
- Drop deprecated middleware.RealIP; add X-Content-Type-Options: nosniff.
- docker-compose credentials come from ${VAR:-default}.
- Check the RegisterValidation error; annotate verified gosec false
  positives with #nosec and a reason.

Re-scan: govulncheck 0 reachable, trivy fs/image 0 High/Critical,
gosec High 0. go test -race passes against PostGIS.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deployments/docker-compose.yml

@@ -1,16 +1,21 @@
+# Credentials below default to well-known development values so that
+# `docker compose up` works out of the box. They MUST be overridden on any
+# shared or reachable host: put strong values for POSTGRES_PASSWORD,
+# MINIO_ROOT_USER, MINIO_ROOT_PASSWORD, RABBITMQ_DEFAULT_USER and
+# RABBITMQ_DEFAULT_PASS in deployments/.env (not committed).
 x-app-common: &app-common
   build:
     context: ..
     dockerfile: build/package/Dockerfile
   environment: &app-environment
     PORT: 8080
-    DB_URL: postgres://gis:gis@postgres:5432/gis?sslmode=disable
+    DB_URL: postgres://gis:${POSTGRES_PASSWORD:-gis}@postgres:5432/gis?sslmode=disable
     S3_ENDPOINT: minio:9000
-    S3_ACCESS_KEY: minioadmin
-    S3_SECRET_KEY: minioadmin
+    S3_ACCESS_KEY: ${MINIO_ROOT_USER:-minioadmin}
+    S3_SECRET_KEY: ${MINIO_ROOT_PASSWORD:-minioadmin}
     S3_BUCKET: geofiles
     S3_USE_SSL: "false"
-    RABBITMQ_URL: amqp://guest:guest@rabbitmq:5672/
+    RABBITMQ_URL: amqp://${RABBITMQ_DEFAULT_USER:-guest}:${RABBITMQ_DEFAULT_PASS:-guest}@rabbitmq:5672/
     RABBITMQ_EXCHANGE: gis.events
     RABBITMQ_QUEUE: gis.events.example
   depends_on:
@@ -47,7 +52,7 @@ services:
     image: postgis/postgis:17-3.5
     environment:
       POSTGRES_USER: gis
-      POSTGRES_PASSWORD: gis
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-gis}
       POSTGRES_DB: gis
     ports:
       - "${DB_PORT:-5432}:5432"
@@ -67,8 +72,8 @@ services:
       - "9000:9000"
       - "9001:9001"
     environment:
-      MINIO_ROOT_USER: minioadmin
-      MINIO_ROOT_PASSWORD: minioadmin
+      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minioadmin}
+      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-minioadmin}
     volumes:
       - minio_data:/data
     healthcheck:
@@ -84,8 +89,8 @@ services:
       - "5672:5672"
       - "15672:15672"
     environment:
-      RABBITMQ_DEFAULT_USER: guest
-      RABBITMQ_DEFAULT_PASS: guest
+      RABBITMQ_DEFAULT_USER: ${RABBITMQ_DEFAULT_USER:-guest}
+      RABBITMQ_DEFAULT_PASS: ${RABBITMQ_DEFAULT_PASS:-guest}
     volumes:
       - rabbitmq_data:/var/lib/rabbitmq
     healthcheck: