Fix all 45 audited bugs from bug-fixes.md

Verified every finding against the code, then fixed correctness (redirects,
advancement reset, duplicate heats, high-jump attempt entry, placement
ranking with tie handling, delete-dependency 500s), security (secrets out of
config, config-driven admin seed, login lockout, role authorization with
school scoping, heat-time IDOR, forwarded headers, last-admin guards),
schema integrity (nullable+filtered ExistingStudentId, unique indexes for
rounds/heats/bar heights via SchemaIntegrityFixes migration), performance
(N+1 removal in high jump/reports/standings/dashboard, SQL-side student
paging), and hygiene (duplicate notifications, auto-dismiss scope, local
bootstrap-icons, orphaned files, test-data.sql tournament creation).

FluentValidation is now registered; AutoMapper bumped to 14.0.0 (advisory
fully patched only in licence-changed 15.1.1 — documented). 11 new tests;
63/63 passing. Credential rotation and deploy-time DB_CONNECTION_STRING are
required manual follow-ups, documented in bug-fixes.md.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -3,13 +3,16 @@ services:
     build:
       context: .
       dockerfile: Dockerfile
-    image: registry.dwarrington.com/sportsdivision:${IMAGE_TAG}
+    image: registry.dwarrington.com/sportsdivision:${IMAGE_TAG:-latest}
     container_name: sportsdivision
     restart: always
     ports:
       - "5039:80"
-    volumes:
-      - ./data:/app/data
+    environment:
+      # Secrets are supplied via the environment (e.g. an untracked .env file),
+      # never committed to the repository.
+      ConnectionStrings__DefaultConnection: ${DB_CONNECTION_STRING:?set DB_CONNECTION_STRING in .env}
+      SeedAdmin__Password: ${SEED_ADMIN_PASSWORD:-}
     networks:
       - caddy_network