Implement Sprint 2 security enhancements

Add user-based rate limiting middleware (100 req/min) for authenticated endpoints using httprate library. Implement common password validation blocking 50+ weak passwords. Improve test coverage from 38.3% to 44.6% with comprehensive refresh token tests.

Security improvements:
- Rate limiting by user ID for /habits and /stats endpoints
- X-RateLimit-Limit header in responses
- Common password blacklist in password validation
- Refresh token test suite with 5 scenarios (valid, invalid, expired, revoked, empty)

internal/infrastructure/http/auth_handlers.go

@@ -13,14 +13,14 @@ import (
 )
 
 type AuthHandlers struct {
-	registerHandler         *commands.RegisterUserHandler
-	loginHandler            *queries.LoginUserHandler
-	refreshTokenHandler     *queries.RefreshTokenHandler
-	revokeTokenHandler      *commands.RevokeTokenHandler
-	revokeAllTokensHandler  *commands.RevokeAllTokensHandler
-	jwtService              *auth.JWTService
-	refreshTokenRepo        repositories.RefreshTokenRepository
-	refreshTokenExpiry      time.Duration
+	registerHandler        *commands.RegisterUserHandler
+	loginHandler           *queries.LoginUserHandler
+	refreshTokenHandler    *queries.RefreshTokenHandler
+	revokeTokenHandler     *commands.RevokeTokenHandler
+	revokeAllTokensHandler *commands.RevokeAllTokensHandler
+	jwtService             *auth.JWTService
+	refreshTokenRepo       repositories.RefreshTokenRepository
+	refreshTokenExpiry     time.Duration
 }
 
 func NewAuthHandlers(