Implement Sprint 2 security enhancements

Add user-based rate limiting middleware (100 req/min) for authenticated endpoints using httprate library. Implement common password validation blocking 50+ weak passwords. Improve test coverage from 38.3% to 44.6% with comprehensive refresh token tests.

Security improvements:
- Rate limiting by user ID for /habits and /stats endpoints
- X-RateLimit-Limit header in responses
- Common password blacklist in password validation
- Refresh token test suite with 5 scenarios (valid, invalid, expired, revoked, empty)

internal/application/commands/mark_habit_test.go

@@ -11,9 +11,9 @@ import (
 )
 
 type mockEntryRepo struct {
-	createFunc               func(ctx context.Context, entry *entities.HabitEntry) error
-	findByDateRangeFunc      func(ctx context.Context, habitID string, from, to time.Time) ([]*entities.HabitEntry, error)
-	updateFunc               func(ctx context.Context, entry *entities.HabitEntry) error
+	createFunc          func(ctx context.Context, entry *entities.HabitEntry) error
+	findByDateRangeFunc func(ctx context.Context, habitID string, from, to time.Time) ([]*entities.HabitEntry, error)
+	updateFunc          func(ctx context.Context, entry *entities.HabitEntry) error
 }
 
 func (m *mockEntryRepo) Create(ctx context.Context, entry *entities.HabitEntry) error {
@@ -537,5 +537,3 @@ func TestMarkHabitHandler_CounterFirstMarkWithNegative(t *testing.T) {
 		t.Fatalf("Expected no error, got %v", err)
 	}
 }
-
-