Add rate limiting for password reset and improve SMTP tests

- Add RateLimitByEmail middleware (3 attempts/hour per email)
- Apply rate limiting to /api/v1/auth/forgot-password endpoint
- Expand SMTP tests with config validation, message types, and error detection
- Improve test coverage from 44.6% to 53.3%

internal/infrastructure/http/router.go

@@ -46,7 +46,9 @@ func NewRouter(appURL string, habitHandlers *HabitHandlers, authHandlers *AuthHa
 		r.Post("/logout", authHandlers.Logout)
 		r.Post("/verify-email", authHandlers.VerifyEmail)
 		r.Post("/resend-verification", authHandlers.ResendVerification)
-		r.Post("/forgot-password", authHandlers.ForgotPassword)
+
+		r.With(RateLimitByEmail(3, 1*time.Hour)).Post("/forgot-password", authHandlers.ForgotPassword)
+
 		r.Post("/reset-password", authHandlers.ResetPassword)
 	})