Close all 25 codex audit findings and add KMP contract tests

Remediate all P0-S priority findings from cross-platform architecture audit:
- Add input validation and authorization checks across handlers
- Harden social auth (Apple/Google) token validation
- Add document ownership verification and file type validation
- Add rate limiting config and CORS origin restrictions
- Add subscription tier enforcement in handlers
- Add OpenAPI 3.0.3 spec (81 schemas, 104 operations)
- Add URL-level contract test (KMP API routes match spec paths)
- Add model-level contract test (65 schemas, 464 fields validated)
- Add CI workflow for backend tests

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/services/task_service.go

@@ -894,6 +894,61 @@ func (s *TaskService) ListCompletions(userID uint) ([]responses.TaskCompletionRe
 	return responses.NewTaskCompletionListResponse(completions), nil
 }
 
+// UpdateCompletion updates an existing task completion
+func (s *TaskService) UpdateCompletion(completionID, userID uint, req *requests.UpdateTaskCompletionRequest) (*responses.TaskCompletionResponse, error) {
+	completion, err := s.taskRepo.FindCompletionByID(completionID)
+	if err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, apperrors.NotFound("error.completion_not_found")
+		}
+		return nil, apperrors.Internal(err)
+	}
+
+	// Check access via task's residence
+	hasAccess, err := s.residenceRepo.HasAccess(completion.Task.ResidenceID, userID)
+	if err != nil {
+		return nil, apperrors.Internal(err)
+	}
+	if !hasAccess {
+		return nil, apperrors.Forbidden("error.task_access_denied")
+	}
+
+	// Apply updates
+	if req.Notes != nil {
+		completion.Notes = *req.Notes
+	}
+	if req.ActualCost != nil {
+		completion.ActualCost = req.ActualCost
+	}
+	if req.Rating != nil {
+		completion.Rating = req.Rating
+	}
+
+	if err := s.taskRepo.UpdateCompletion(completion); err != nil {
+		return nil, apperrors.Internal(err)
+	}
+
+	// Add any new images
+	for _, imageURL := range req.ImageURLs {
+		image := &models.TaskCompletionImage{
+			CompletionID: completion.ID,
+			ImageURL:     imageURL,
+		}
+		if err := s.taskRepo.CreateCompletionImage(image); err != nil {
+			log.Error().Err(err).Uint("completion_id", completion.ID).Msg("Failed to create completion image during update")
+		}
+	}
+
+	// Reload to get full associations
+	updated, err := s.taskRepo.FindCompletionByID(completionID)
+	if err != nil {
+		return nil, apperrors.Internal(err)
+	}
+
+	resp := responses.NewTaskCompletionResponse(updated)
+	return &resp, nil
+}
+
 // DeleteCompletion deletes a task completion
 func (s *TaskService) DeleteCompletion(completionID, userID uint) (*responses.DeleteWithSummaryResponse, error) {
 	completion, err := s.taskRepo.FindCompletionByID(completionID)