fix(security): close High/Critical findings from the Stage 8 scan

- Bump github.com/rabbitmq/amqp091-go 1.12.0 -> 1.13.0 (3 Critical, 7 High,
  reachable via rabbitmq.Connect) and golang.org/x/{text,net,crypto},
  klauspost/compress; toolchain go1.26.8, builder image pinned to
  golang:1.26.8-alpine3.24.
- Build Content-Disposition per RFC 6266/8187 (ASCII fallback +
  filename*=UTF-8''), stripping CR/LF, quotes and backslashes (CWE-113).
- Cap request bodies with MaxBytesReader (HTTP_MAX_UPLOAD_BYTES, default
  2 GiB); multipart uploads over the limit return 413 (CWE-400).
- /readyz reports "unavailable" instead of raw backend errors (CWE-209).
- Drop deprecated middleware.RealIP; add X-Content-Type-Options: nosniff.
- docker-compose credentials come from ${VAR:-default}.
- Check the RegisterValidation error; annotate verified gosec false
  positives with #nosec and a reason.

Re-scan: govulncheck 0 reachable, trivy fs/image 0 High/Critical,
gosec High 0. go test -race passes against PostGIS.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/raster/gdal.go

@@ -25,7 +25,8 @@ func NewGDALConverter() *GDALConverter {
 // ToCOG converts the source raster to a Cloud-Optimized GeoTIFF at dst. The COG
 // driver builds internal tiling and overviews.
 func (c *GDALConverter) ToCOG(ctx context.Context, src, dst string) error {
-	cmd := exec.CommandContext(ctx, "gdal_translate",
+	// Fixed binary, no shell; src/dst are service-generated temp-file paths.
+	cmd := exec.CommandContext(ctx, "gdal_translate", // #nosec G204 -- see above
 		"-of", "COG",
 		"-co", "COMPRESS="+c.compression,
 		src, dst,
@@ -41,7 +42,7 @@ func (c *GDALConverter) ToCOG(ctx context.Context, src, dst string) error {
 // Footprint returns the raster's footprint as a GeoJSON polygon in EPSG:4326, or
 // nil if the raster has no spatial reference.
 func (c *GDALConverter) Footprint(ctx context.Context, src string) ([]byte, error) {
-	out, err := exec.CommandContext(ctx, "gdalinfo", "-json", src).Output()
+	out, err := exec.CommandContext(ctx, "gdalinfo", "-json", src).Output() // #nosec G204 -- fixed binary, no shell; src is a service temp file
 	if err != nil {
 		return nil, fmt.Errorf("gdalinfo: %w", err)
 	}
@@ -72,7 +73,8 @@ func (c *GDALConverter) VectorFeatures(ctx context.Context, src string) ([]json.
 		input = "/vsizip/" + src
 	}
 
-	cmd := exec.CommandContext(ctx, "ogr2ogr",
+	// Fixed binary, no shell; input is a service-generated temp-file path.
+	cmd := exec.CommandContext(ctx, "ogr2ogr", // #nosec G204 -- see above
 		"-f", "GeoJSON",
 		"-t_srs", "EPSG:4326",
 		"/vsistdout/", input,