feat: Add XSS protection and HATEOAS links to subscriber and auth handlers with cursor pagination

- Add bluemonday import to auth.go and subscriber.go
- Add UGCPolicy sanitization for username, email, firstName, lastName, and role in Register
- Add conditional XSS sanitization for firstName, lastName, email, and MSISDN in CreateSubscriber and UpdateSubscriber
- Replace Page and PageSize with Cursor and Limit in ListSubscribers query parameters
- Add HATEOAS links to CreateSubscriber, GetSubscriber

apps/api-server/internal/handlers/auth.go

@@ -6,6 +6,7 @@ import (
 	"strings"
 
 	"github.com/gin-gonic/gin"
+	"github.com/microcosm-cc/bluemonday"
 	"github.com/nutcas3/telecom-platform/apps/api-server/internal/models"
 	"github.com/nutcas3/telecom-platform/apps/api-server/internal/services"
 )
@@ -82,6 +83,14 @@ func (h *AuthHandler) Register(c *gin.Context) {
 		return
 	}
 
+	// Sanitize user input to prevent XSS
+	policy := bluemonday.UGCPolicy()
+	req.Username = policy.Sanitize(req.Username)
+	req.Email = policy.Sanitize(req.Email)
+	req.FirstName = policy.Sanitize(req.FirstName)
+	req.LastName = policy.Sanitize(req.LastName)
+	req.Role = policy.Sanitize(req.Role)
+
 	user, err := h.authService.Register(req.Username, req.Email, req.Password, req.FirstName, req.LastName, req.Role)
 	if err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})