Implement Sprint 2 security enhancements

Add user-based rate limiting middleware (100 req/min) for authenticated endpoints using httprate library. Implement common password validation blocking 50+ weak passwords. Improve test coverage from 38.3% to 44.6% with comprehensive refresh token tests.

Security improvements:
- Rate limiting by user ID for /habits and /stats endpoints
- X-RateLimit-Limit header in responses
- Common password blacklist in password validation
- Refresh token test suite with 5 scenarios (valid, invalid, expired, revoked, empty)

internal/application/commands/register_user_test.go

@@ -262,9 +262,9 @@ func TestRegisterUserHandler_EdgeCases(t *testing.T) {
 	handler := NewRegisterUserHandler(repo, hasher)
 
 	tests := []struct {
-		name     string
-		cmd      RegisterUserCommand
-		wantErr  error
+		name    string
+		cmd     RegisterUserCommand
+		wantErr error
 	}{
 		{
 			"email with plus addressing",