fix(security): close High/Critical findings from the Stage 8 scan

- Bump github.com/rabbitmq/amqp091-go 1.12.0 -> 1.13.0 (3 Critical, 7 High,
  reachable via rabbitmq.Connect) and golang.org/x/{text,net,crypto},
  klauspost/compress; toolchain go1.26.8, builder image pinned to
  golang:1.26.8-alpine3.24.
- Build Content-Disposition per RFC 6266/8187 (ASCII fallback +
  filename*=UTF-8''), stripping CR/LF, quotes and backslashes (CWE-113).
- Cap request bodies with MaxBytesReader (HTTP_MAX_UPLOAD_BYTES, default
  2 GiB); multipart uploads over the limit return 413 (CWE-400).
- /readyz reports "unavailable" instead of raw backend errors (CWE-209).
- Drop deprecated middleware.RealIP; add X-Content-Type-Options: nosniff.
- docker-compose credentials come from ${VAR:-default}.
- Check the RegisterValidation error; annotate verified gosec false
  positives with #nosec and a reason.

Re-scan: govulncheck 0 reachable, trivy fs/image 0 High/Critical,
gosec High 0. go test -race passes against PostGIS.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/landscape/kernels.go

@@ -156,12 +156,15 @@ func kernelMaxAnyValid(in [][]float64, out [][]int16, _ Params) {
 // S1..S5 (irrigation, snow, crop, pasture, tourism). Outputs: V1, V2, V3.
 func kernelFuncZoning(in [][]float64, out [][]int16, p Params) {
 	e := in[0]
+	// The int16 conversions below cannot overflow (gosec G115): thresholds and
+	// tie_priority codes are limited to 1..5 by Params.Validate, and pixel
+	// values are converted only after valid() has bounded them to 1..5.
 	rules := [3]func(e, s int16) bool{
 		func(e, s int16) bool {
-			return (e <= 2 && s >= int16(p.V1MinSE12)) || (e == 3 && s >= int16(p.V1MinSE3))
+			return (e <= 2 && s >= int16(p.V1MinSE12)) || (e == 3 && s >= int16(p.V1MinSE3)) // #nosec G115 -- 1..5, see above
 		},
 		func(e, s int16) bool {
-			return e <= 2 || (e == 3 && s >= int16(p.V2MinSE3)) || (e == 4 && s >= int16(p.V2MinSE4))
+			return e <= 2 || (e == 3 && s >= int16(p.V2MinSE3)) || (e == 4 && s >= int16(p.V2MinSE4)) // #nosec G115 -- 1..5, see above
 		},
 		func(e, s int16) bool { return e <= 4 },
 	}
@@ -205,7 +208,7 @@ func kernelFuncZoning(in [][]float64, out [][]int16, p Params) {
 			for _, code := range p.TiePriority {
 				k := code - 1
 				if cand[k] && s[k] == maxS {
-					sector = int16(code)
+					sector = int16(code) // #nosec G115 -- tie_priority code is 1..5, see above
 					break
 				}
 			}