Close all 25 codex audit findings and add KMP contract tests

Remediate all P0-S priority findings from cross-platform architecture audit:
- Add input validation and authorization checks across handlers
- Harden social auth (Apple/Google) token validation
- Add document ownership verification and file type validation
- Add rate limiting config and CORS origin restrictions
- Add subscription tier enforcement in handlers
- Add OpenAPI 3.0.3 spec (81 schemas, 104 operations)
- Add URL-level contract test (KMP API routes match spec paths)
- Add model-level contract test (65 schemas, 464 fields validated)
- Add CI workflow for backend tests

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Makefile

@@ -1,4 +1,4 @@
-.PHONY: build run test clean deps lint docker-build docker-up docker-down migrate
+.PHONY: build run test contract-test clean deps lint docker-build docker-up docker-down migrate
 
 # Binary names
 API_BINARY=casera-api
@@ -47,6 +47,10 @@ run-admin:
 test:
 	go test -v -race -cover ./...
 
+# Run contract validation tests (routes + KMP vs OpenAPI spec)
+contract-test:
+	go test -v -run "TestRouteSpecContract|TestKMPSpecContract" ./internal/integration/
+
 # Run tests with coverage
 test-coverage:
 	go test -v -race -coverprofile=coverage.out ./...