fix: 3차 리뷰 LOW — 에러 메시지 일관성, Redis 타임아웃, 입력 검증

- 5개 핸들러 err.Error() → 제네릭 메시지 (Login, Refresh, SSAFY, Ticket, BossRaid)
- Redis context.Background() → WithTimeout 5s (10곳)
- SprintMultiplier 범위 검증 추가
- 방어적 문서화 (SSAFY 충돌, zip bomb, body limit prefix, 로그 주입)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

pkg/middleware/bodylimit.go

@@ -11,6 +11,8 @@ import (
 // bypass this check. Fiber's global BodyLimit provides the final safety net.
 // Paths matching any of the excludePrefixes are skipped (e.g. upload endpoints
 // that legitimately need the global 4GB limit).
+// NOTE: excludePrefixes uses HasPrefix matching. Ensure no unintended
+// routes share the same prefix as upload endpoints.
 func BodyLimit(maxBytes int, excludePrefixes ...string) fiber.Handler {
 	return func(c *fiber.Ctx) error {
 		for _, prefix := range excludePrefixes {