v0.1.17: security hardening — 18/20 vulnerabilities fixed

Phase 1 (Critical):
- #1 JWT auth (done in v0.1.16)
- #2 Batch message size validation in send_message_batch.go
- #10 RLock in GetQueueUrlV1 (data race fix)

Phase 2 (AWS-compatible limits):
- #3 QueueName validation: max 80 chars, [a-zA-Z0-9_-](.fifo)?
- #4 WaitTimeSeconds clamped to 0-20
- #5 ReceiveMessageWaitTimeSeconds clamped to 0-20
- #6 DelaySeconds clamped to 0-900
- #7 VisibilityTimeout clamped to 0-43200
- #8 MaxNumberOfMessages clamped to 1-10
- #9 Message attributes limited to 10 per message
- #15 BatchEntryId length validated (max 80)
- #16 DeduplicationID length validated (max 128)
- #17 GroupID length validated (max 128)

Phase 3 (Per-tenant resource limits):
- #11 Max messages per queue (120K standard, 20K FIFO)
- #12 Global tenant limit (1000)
- #3.5 HTTP request body size limit (1MB via MaxBytesReader)

Phase 4 (Stability):
- #14 Duplicates map cleanup (already in PeriodicTasks)
- #13 FIFO group lock timeout (already in visibility timeout reset)
- #18 Redis size guard: skip save if >50MB

Skipped (Low, no real risk):
- #19 {account} URL param (informational only, not used for access)
- #20 ReceiptHandle format (self-validating UUID#UUID)

New file: app/gosqs/validation.go — centralized AWS SQS limits and validators

app/router/router.go

@@ -26,6 +26,10 @@ import (
 func New(tenantStore *tenant.TenantStore, adminToken string) http.Handler {
 	r := mux.NewRouter()
 
+	// Fix #3.5: глобальный лимит размера тела HTTP запроса — 1MB
+	// Защита от OOM при отправке гигантских batch/message requests
+	r.Use(requestBodyLimitMiddleware)
+
 	// /health — публичный, без auth
 	r.HandleFunc("/health", health).Methods("GET")
 
@@ -53,6 +57,17 @@ func New(tenantStore *tenant.TenantStore, adminToken string) http.Handler {
 	return r
 }
 
+// requestBodyLimitMiddleware — ограничивает размер тела HTTP запроса до 1MB.
+// Защита от OOM при отправке гигантских messages/batch (Fix #3.5).
+func requestBodyLimitMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Body != nil {
+			r.Body = http.MaxBytesReader(w, r.Body, 1*1024*1024) // 1MB
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
 func encodeResponse(w http.ResponseWriter, req *http.Request, statusCode int, body interfaces.AbstractResponseBody) {
 	protocol := resolveProtocol(req)
 	switch protocol {