Implement Sprint 2 security enhancements

Add user-based rate limiting middleware (100 req/min) for authenticated endpoints using httprate library. Implement common password validation blocking 50+ weak passwords. Improve test coverage from 38.3% to 44.6% with comprehensive refresh token tests.

Security improvements:
- Rate limiting by user ID for /habits and /stats endpoints
- X-RateLimit-Limit header in responses
- Common password blacklist in password validation
- Refresh token test suite with 5 scenarios (valid, invalid, expired, revoked, empty)

internal/application/queries/get_habit_stats.go

@@ -10,14 +10,14 @@ import (
 )
 
 type HabitStatsDTO struct {
-	HabitID            string  `json:"habit_id"`
-	HabitName          string  `json:"habit_name"`
-	TotalCompletions   int     `json:"total_completions"`
-	CurrentStreak      int     `json:"current_streak"`
-	LongestStreak      int     `json:"longest_streak"`
-	CompletionRate     float64 `json:"completion_rate"`
-	CompletionsThisWeek int    `json:"completions_this_week"`
-	CompletionsThisMonth int   `json:"completions_this_month"`
+	HabitID              string  `json:"habit_id"`
+	HabitName            string  `json:"habit_name"`
+	TotalCompletions     int     `json:"total_completions"`
+	CurrentStreak        int     `json:"current_streak"`
+	LongestStreak        int     `json:"longest_streak"`
+	CompletionRate       float64 `json:"completion_rate"`
+	CompletionsThisWeek  int     `json:"completions_this_week"`
+	CompletionsThisMonth int     `json:"completions_this_month"`
 }
 
 type GetHabitStatsQuery struct {