Close all 25 codex audit findings and add KMP contract tests

Remediate all P0-S priority findings from cross-platform architecture audit:
- Add input validation and authorization checks across handlers
- Harden social auth (Apple/Google) token validation
- Add document ownership verification and file type validation
- Add rate limiting config and CORS origin restrictions
- Add subscription tier enforcement in handlers
- Add OpenAPI 3.0.3 spec (81 schemas, 104 operations)
- Add URL-level contract test (KMP API routes match spec paths)
- Add model-level contract test (65 schemas, 464 fields validated)
- Add CI workflow for backend tests

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/repositories/task_repo.go

@@ -614,6 +614,11 @@ func (r *TaskRepository) FindCompletionsByUser(userID uint, residenceIDs []uint)
 	return completions, err
 }
 
+// UpdateCompletion updates an existing task completion
+func (r *TaskRepository) UpdateCompletion(completion *models.TaskCompletion) error {
+	return r.db.Omit("Task", "CompletedBy", "Images").Save(completion).Error
+}
+
 // DeleteCompletion deletes a task completion
 func (r *TaskRepository) DeleteCompletion(id uint) error {
 	// Delete images first