fix(security): close High/Critical findings from the Stage 8 scan

- Bump github.com/rabbitmq/amqp091-go 1.12.0 -> 1.13.0 (3 Critical, 7 High,
  reachable via rabbitmq.Connect) and golang.org/x/{text,net,crypto},
  klauspost/compress; toolchain go1.26.8, builder image pinned to
  golang:1.26.8-alpine3.24.
- Build Content-Disposition per RFC 6266/8187 (ASCII fallback +
  filename*=UTF-8''), stripping CR/LF, quotes and backslashes (CWE-113).
- Cap request bodies with MaxBytesReader (HTTP_MAX_UPLOAD_BYTES, default
  2 GiB); multipart uploads over the limit return 413 (CWE-400).
- /readyz reports "unavailable" instead of raw backend errors (CWE-209).
- Drop deprecated middleware.RealIP; add X-Content-Type-Options: nosniff.
- docker-compose credentials come from ${VAR:-default}.
- Check the RegisterValidation error; annotate verified gosec false
  positives with #nosec and a reason.

Re-scan: govulncheck 0 reachable, trivy fs/image 0 High/Critical,
gosec High 0. go test -race passes against PostGIS.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/app/app.go

@@ -108,15 +108,18 @@ func New(ctx context.Context) (*App, error) {
 // Handler builds the HTTP handler with all routes and readiness checks wired.
 func (a *App) Handler() stdhttp.Handler {
 	validate := validator.New(validator.WithRequiredStructEnabled())
-	validate.RegisterValidation("slug", func(fl validator.FieldLevel) bool {
+	if err := validate.RegisterValidation("slug", func(fl validator.FieldLevel) bool {
 		return domain.ValidSlug(fl.Field().String())
-	})
+	}); err != nil {
+		// Only fails for an empty tag or nil func: a programming error.
+		panic(fmt.Sprintf("register slug validation: %v", err))
+	}
 
 	health := transporthttp.NewHealthHandler(map[string]transporthttp.ReadinessCheck{
 		"postgres": func(ctx context.Context) error { return a.pool.Ping(ctx) },
 		"s3":       func(ctx context.Context) error { return a.store.Ping(ctx) },
 		"rabbitmq": func(_ context.Context) error { return a.rabbit.Ping() },
-	})
+	}, a.Log)
 
 	return transporthttp.NewRouter(transporthttp.RouterDeps{
 		Logger:        a.Log,
@@ -126,6 +129,7 @@ func (a *App) Handler() stdhttp.Handler {
 		DatasetGroups: transporthttp.NewDatasetGroupHandler(a.groups, validate),
 		Landscape:     transporthttp.NewLandscapeHandler(a.landscape, validate),
 		OpenAPISpec:   api.Spec,
+		MaxBodyBytes:  a.Cfg.HTTP.MaxUploadBytes,
 	})
 }