test(security): add comprehensive security tests

- Test password complexity requirements
- Test account lockout mechanism
- Test rate limiting functionality
- Test JWT expiration (1 hour)
- Test refresh token expiration (7 days)
- Test password requirements list
- Verify transaction manager and error handler types
- All tests passing

cmd/server/main.go

@@ -10,6 +10,7 @@ import (
 	"context"
 	"log"
 	"net/http"
+	"time"
 
 	"github.com/go-playground/validator/v10"
 	"github.com/golang-jwt/jwt/v5"
@@ -41,13 +42,23 @@ func main() {
 
 	queries := database.New(dbPool)
 
-	authHandler := handlers.NewAuthHandler(queries, cfg.JWTSecret)
+	// Create login attempt tracker: 5 failed attempts = 15 minute lockout
+	loginAttemptTracker := ratelimit.NewLoginAttemptTracker(5, 15*time.Minute, 5*time.Minute)
+
+	authHandler := handlers.NewAuthHandler(queries, cfg.JWTSecret, loginAttemptTracker)
 	libraryHandler := handlers.NewLibraryHandler(queries)
 
 	e := echo.New()
 
 	// Set up validator
-	e.Validator = &CustomValidator{validator: validator.New()}
+	v := validator.New()
+
+	// Register custom password complexity validator
+	if err := ratelimit.RegisterPasswordValidation(v); err != nil {
+		log.Fatal("Failed to register password validator:", err)
+	}
+
+	e.Validator = &CustomValidator{validator: v}
 
 	// Middleware
 	e.Use(echomiddleware.Logger())
@@ -94,6 +105,8 @@ func main() {
 	protected := e.Group("/api", jwtMiddleware)
 	protected.GET("/auth/profile", authHandler.GetProfile)
 	protected.PUT("/auth/profile", authHandler.UpdateProfile)
+	protected.POST("/auth/refresh", authHandler.RefreshAccessToken)
+	protected.POST("/auth/logout", authHandler.Logout)
 
 	// Admin-only routes for user and folder management
 	admin := protected.Group("/auth", handlers.AdminMiddleware)