fix: critical security vulnerabilities
- Fix type assertion panics in auth.go (9 handlers)
* GetProfile, UpdateProfile, UpdateTheme, UpdateUsername
* UpdateEmail, UpdatePassword, DeleteAccount
* UpdateScanSettings, GetScanSettings, Register admin check
* Replace c.Get("user_id").(string) with MustGetAuthenticatedUser()
- Fix type assertion panic in library.go
* GetUserVisibleLibraries now uses MustGetAuthenticatedUser()
- Add path traversal protection to AddLibraryFolder
* Detect and block ".." in paths
* Clean paths with filepath.Clean()
* Verify path is a directory before adding
- Remove debug logging from Login handler
* Removed all fmt.Printf statements
* No more plaintext password logging
- Create safe context helper functions
* internal/handlers/context.go added
* GetAuthenticatedUser() for safe retrieval
* MustGetAuthenticatedUser() for post-auth middleware
Security: Critical
Tests: All 62 integration tests pass
Breaking: None - backward compatible
john-okeefe
420af7978a