Close all 25 codex audit findings and add KMP contract tests

Remediate all P0-S priority findings from cross-platform architecture audit:
- Add input validation and authorization checks across handlers
- Harden social auth (Apple/Google) token validation
- Add document ownership verification and file type validation
- Add rate limiting config and CORS origin restrictions
- Add subscription tier enforcement in handlers
- Add OpenAPI 3.0.3 spec (81 schemas, 104 operations)
- Add URL-level contract test (KMP API routes match spec paths)
- Add model-level contract test (65 schemas, 464 fields validated)
- Add CI workflow for backend tests

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/dto/requests/task.go

@@ -94,6 +94,14 @@ type CreateTaskCompletionRequest struct {
 	ImageURLs   []string         `json:"image_urls"` // Multiple image URLs
 }
 
+// UpdateTaskCompletionRequest represents the request to update a task completion
+type UpdateTaskCompletionRequest struct {
+	Notes      *string          `json:"notes"`
+	ActualCost *decimal.Decimal `json:"actual_cost"`
+	Rating     *int             `json:"rating"`
+	ImageURLs  []string         `json:"image_urls"`
+}
+
 // CompletionImageInput represents an image to add to a completion
 type CompletionImageInput struct {
 	ImageURL string `json:"image_url" validate:"required"`