fix(security): close High/Critical findings from the Stage 8 scan

- Bump github.com/rabbitmq/amqp091-go 1.12.0 -> 1.13.0 (3 Critical, 7 High,
  reachable via rabbitmq.Connect) and golang.org/x/{text,net,crypto},
  klauspost/compress; toolchain go1.26.8, builder image pinned to
  golang:1.26.8-alpine3.24.
- Build Content-Disposition per RFC 6266/8187 (ASCII fallback +
  filename*=UTF-8''), stripping CR/LF, quotes and backslashes (CWE-113).
- Cap request bodies with MaxBytesReader (HTTP_MAX_UPLOAD_BYTES, default
  2 GiB); multipart uploads over the limit return 413 (CWE-400).
- /readyz reports "unavailable" instead of raw backend errors (CWE-209).
- Drop deprecated middleware.RealIP; add X-Content-Type-Options: nosniff.
- docker-compose credentials come from ${VAR:-default}.
- Check the RegisterValidation error; annotate verified gosec false
  positives with #nosec and a reason.

Re-scan: govulncheck 0 reachable, trivy fs/image 0 High/Critical,
gosec High 0. go test -race passes against PostGIS.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/transport/http/router.go

@@ -19,16 +19,23 @@ type RouterDeps struct {
 	// Landscape serves the /landscape routes.
 	Landscape   *LandscapeHandler
 	OpenAPISpec []byte
+	// MaxBodyBytes caps every request body (uploads included); <= 0 disables
+	// the cap.
+	MaxBodyBytes int64
 }
 
 // NewRouter builds the application's HTTP handler with middleware and routes.
 func NewRouter(deps RouterDeps) http.Handler {
 	r := chi.NewRouter()
 
+	// middleware.RealIP is deliberately not used: it rewrites r.RemoteAddr
+	// from client-controlled headers (X-Forwarded-For, X-Real-IP,
+	// True-Client-IP) and is deprecated upstream as an IP-spoofing vector.
 	r.Use(middleware.RequestID)
-	r.Use(middleware.RealIP)
 	r.Use(requestLogger(deps.Logger))
 	r.Use(middleware.Recoverer)
+	r.Use(securityHeaders)
+	r.Use(limitRequestBody(deps.MaxBodyBytes))
 
 	// Health/readiness endpoints.
 	r.Get("/healthz", deps.Health.Live)