feat(security): add password complexity validator

- Implement strict password requirements:
  - Minimum 8 characters
  - At least one uppercase letter
  - At least one lowercase letter
  - At least one number
  - At least one special character
- Add custom validator for Echo integration
- Add GetPasswordRequirements helper function
- Add ValidatePassword function for manual validation

internal/database/queries/queries.sql

@@ -377,4 +377,25 @@ WHERE id = $1
 RETURNING *;
 
 -- name: DeleteEbookHighlight :exec
-DELETE FROM media_highlights WHERE id = $1;
+DELETE FROM media_highlights WHERE id = $1;
+
+-- Refresh Tokens queries
+-- name: CreateRefreshToken :one
+INSERT INTO refresh_tokens (user_id, token, expires_at)
+VALUES ($1, $2, $3)
+RETURNING *;
+
+-- name: GetRefreshToken :one
+SELECT rt.*, u.email, u.username, u.role
+FROM refresh_tokens rt
+JOIN users u ON rt.user_id = u.id
+WHERE rt.token = $1 AND rt.revoked_at IS NULL AND rt.expires_at > NOW();
+
+-- name: RevokeRefreshToken :exec
+UPDATE refresh_tokens SET revoked_at = NOW() WHERE token = $1;
+
+-- name: RevokeAllUserRefreshTokens :exec
+UPDATE refresh_tokens SET revoked_at = NOW() WHERE user_id = $1 AND revoked_at IS NULL;
+
+-- name: CleanupExpiredRefreshTokens :exec
+DELETE FROM refresh_tokens WHERE expires_at < NOW() OR (revoked_at IS NOT NULL AND revoked_at < NOW() - INTERVAL '7 days');