Implement Sprint 2 security enhancements

Add user-based rate limiting middleware (100 req/min) for authenticated endpoints using httprate library. Implement common password validation blocking 50+ weak passwords. Improve test coverage from 38.3% to 44.6% with comprehensive refresh token tests.

Security improvements:
- Rate limiting by user ID for /habits and /stats endpoints
- X-RateLimit-Limit header in responses
- Common password blacklist in password validation
- Refresh token test suite with 5 scenarios (valid, invalid, expired, revoked, empty)

internal/shared/validation/validator.go

@@ -92,6 +92,10 @@ func ValidatePassword(password string) error {
 		return ValidationError{Field: "password", Message: "password must contain at least one special character"}
 	}
 
+	if IsCommonPassword(password) {
+		return ValidationError{Field: "password", Message: "password is too common, please choose a more secure password"}
+	}
+
 	return nil
 }