[kit-layout][Audit 2026-04-14] API contract and validation defects

[yanghao1143]

Summary

go-saas/kit-layout issues are disabled; tracking this audit item in go-saas/kit.

Findings (kit-layout)

• High | confirmed delete API lacks required id validation.
  • Evidence: kit-layout/api/post/v1/post.proto:87, kit-layout/api/post/v1/post.pb.validate.go:456, kit-layout/private/service/post.go:101
• High | confirmed list API lacks bounded page_size max.
  • Evidence: kit-layout/api/post/v1/post.proto:104, :105, kit-layout/api/post/v1/post.pb.validate.go:932, :934
• High | confirmed update mask ignored; partial update semantics broken.
  • Evidence: kit-layout/api/post/v1/post.proto:78, kit-layout/private/service/post.go:91, :124
• Medium | confirmed NotFound responses use empty reason/message.
  • Evidence: kit-layout/private/service/post.go:59, :88, :109
• Medium | confirmed swagger router not mounted, docs endpoint unreachable.
  • Evidence: kit-layout/private/service/service.go:34, :38

Suggested Direction

• Tighten proto/service validations and resource IDs.
• Enforce update-mask behavior.
• Return structured error reasons.
• Mount swagger route explicitly.