fix: code health sweep — M-01 through M-07
M-01 authz.py: move cache_key above try block to avoid NameError when
first Redis call returns None
M-02 main.py: re-enable validation middleware (was TEMPORARILY DISABLED)
M-03 routes_auth.py / main.py: replace print() debug lines with
structured logger calls; logger now module-level in routes_auth.py
M-04 gcs.py: asyncio.get_event_loop() → get_running_loop() (deprecation)
M-05 translate_and_synthesize.py: bind loop vars in closure defaults
to fix B023 ruff warnings (transcreate/translate_captions/etc.)
M-06 rate_limiting.py: only trust X-Forwarded-For when X-Forwarded-Proto
is https; use rightmost entry (proxy-appended) not leftmost
M-07 validation.py: extend MongoDB operator blocklist to cover $expr,
$function, $accumulator, $nin, $gte, $lte, $jsonSchema, $mod
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
4c6624c3d4