Implement Sprint 2 security enhancements

Add user-based rate limiting middleware (100 req/min) for authenticated endpoints using httprate library. Implement common password validation blocking 50+ weak passwords. Improve test coverage from 38.3% to 44.6% with comprehensive refresh token tests.

Security improvements:
- Rate limiting by user ID for /habits and /stats endpoints
- X-RateLimit-Limit header in responses
- Common password blacklist in password validation
- Refresh token test suite with 5 scenarios (valid, invalid, expired, revoked, empty)

internal/domain/entities/habit_entry_test.go

@@ -43,4 +43,3 @@ func TestNewHabitEntry_BooleanHabit(t *testing.T) {
 		t.Error("Value should be nil for boolean habit")
 	}
 }
-

internal/domain/value_objects/habit_type_json_test.go

@@ -7,9 +7,9 @@ import (
 
 func TestHabitType_MarshalJSON(t *testing.T) {
 	tests := []struct {
-		name     string
+		name      string
 		habitType HabitType
-		expected string
+		expected  string
 	}{
 		{"Boolean", HabitTypeBoolean, `"BOOLEAN"`},
 		{"Counter", HabitTypeCounter, `"COUNTER"`},