Close all 25 codex audit findings and add KMP contract tests

Remediate all P0-S priority findings from cross-platform architecture audit:
- Add input validation and authorization checks across handlers
- Harden social auth (Apple/Google) token validation
- Add document ownership verification and file type validation
- Add rate limiting config and CORS origin restrictions
- Add subscription tier enforcement in handlers
- Add OpenAPI 3.0.3 spec (81 schemas, 104 operations)
- Add URL-level contract test (KMP API routes match spec paths)
- Add model-level contract test (65 schemas, 464 fields validated)
- Add CI workflow for backend tests

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/services/notification_service.go

@@ -372,6 +372,39 @@ func (s *NotificationService) DeleteDevice(deviceID uint, platform string, userI
 	return nil
 }
 
+// UnregisterDevice deactivates a device by its registration token
+func (s *NotificationService) UnregisterDevice(registrationID, platform string, userID uint) error {
+	switch platform {
+	case push.PlatformIOS:
+		device, err := s.notificationRepo.FindAPNSDeviceByToken(registrationID)
+		if err != nil {
+			return apperrors.NotFound("error.device_not_found")
+		}
+		// Verify ownership
+		if device.UserID == nil || *device.UserID != userID {
+			return apperrors.NotFound("error.device_not_found")
+		}
+		if err := s.notificationRepo.DeactivateAPNSDevice(device.ID); err != nil {
+			return apperrors.Internal(err)
+		}
+	case push.PlatformAndroid:
+		device, err := s.notificationRepo.FindGCMDeviceByToken(registrationID)
+		if err != nil {
+			return apperrors.NotFound("error.device_not_found")
+		}
+		// Verify ownership
+		if device.UserID == nil || *device.UserID != userID {
+			return apperrors.NotFound("error.device_not_found")
+		}
+		if err := s.notificationRepo.DeactivateGCMDevice(device.ID); err != nil {
+			return apperrors.Internal(err)
+		}
+	default:
+		return apperrors.BadRequest("error.invalid_platform")
+	}
+	return nil
+}
+
 // === Response/Request Types ===
 
 // NotificationResponse represents a notification in API response