Implement Sprint 2 security enhancements

Add user-based rate limiting middleware (100 req/min) for authenticated endpoints using httprate library. Implement common password validation blocking 50+ weak passwords. Improve test coverage from 38.3% to 44.6% with comprehensive refresh token tests.

Security improvements:
- Rate limiting by user ID for /habits and /stats endpoints
- X-RateLimit-Limit header in responses
- Common password blacklist in password validation
- Refresh token test suite with 5 scenarios (valid, invalid, expired, revoked, empty)

internal/shared/utils/date_utils_test.go

@@ -21,25 +21,25 @@ func TestShouldAppearToday_Weekly(t *testing.T) {
 	}{
 		{
 			name:         "Monday when Monday is specified",
-			specificDays: []int{1}, // Monday
+			specificDays: []int{1},                                    // Monday
 			targetDate:   time.Date(2025, 1, 6, 0, 0, 0, 0, time.UTC), // Monday
 			expected:     true,
 		},
 		{
 			name:         "Tuesday when Monday is specified",
-			specificDays: []int{1}, // Monday
+			specificDays: []int{1},                                    // Monday
 			targetDate:   time.Date(2025, 1, 7, 0, 0, 0, 0, time.UTC), // Tuesday
 			expected:     false,
 		},
 		{
 			name:         "Wednesday when Mon/Wed/Fri specified",
-			specificDays: []int{1, 3, 5}, // Mon, Wed, Fri
+			specificDays: []int{1, 3, 5},                              // Mon, Wed, Fri
 			targetDate:   time.Date(2025, 1, 8, 0, 0, 0, 0, time.UTC), // Wednesday
 			expected:     true,
 		},
 		{
 			name:         "Sunday when Mon/Wed/Fri specified",
-			specificDays: []int{1, 3, 5}, // Mon, Wed, Fri
+			specificDays: []int{1, 3, 5},                              // Mon, Wed, Fri
 			targetDate:   time.Date(2025, 1, 5, 0, 0, 0, 0, time.UTC), // Sunday
 			expected:     false,
 		},