fix(backend): P1 — handler unwrap cleanup + rewrite integration tests

P1 items #6 (JWT expiry) and #7 (refresh/logout routes) were already delivered
in the P0 pass. This commit covers the two remaining P1 items:

#9 — Replace dangerous handler-level .unwrap() calls (13 sites):
* handlers/users.rs: 5x ObjectId::parse_str(&claims.sub).unwrap() in
  get_profile/update_profile/delete_account/get_settings/update_settings now
  return 401 on a malformed subject instead of panicking (matches the guard
  already used in change_password).
* handlers/auth.rs: the login user.id.ok_or_else(..).unwrap() was a latent
  panic bug — the crafted 500 response was discarded. Now returns the clean
  500 via match.
* handlers/health_stats.rs: 6x state.health_stats_repo.as_ref().unwrap() now
  return 503 SERVICE_UNAVAILABLE if the feature is unconfigured, mirroring the
  interactions.rs pattern.
* Left untouched: 14 test/boot-time unwraps and 7 infallible ones (header
  literal parsing, infallible TryFrom). The 3 borderline model-layer
  inserted_id unwraps are flagged for later.

#8 — Rewrite the broken integration tests against a real test DB:
* Split the crate into bin+lib: new src/lib.rs + src/app.rs (build_app), with
  main.rs now a thin entrypoint. Tests build the exact production router
  in-process instead of hitting a live server on a hardcoded port.
* tests/common/mod.rs: helpers that connect to Mongo, build a fresh AppState
  against a unique per-process DB (normogen_test_<uuid>), and tear it down.
  A 1s connectivity probe makes tests skip gracefully when Mongo is absent, so
  'cargo test' stays green without Mongo — CI runs them for real.
* Rewrote tests/auth_tests.rs and tests/medication_tests.rs with the ACTUAL
  API contracts (POST /register {email,username,password}; response has token
  + refresh_token, not access_token; register returns 201). Covers register,
  login (right/wrong password), auth enforcement, refresh rotation + reuse
  detection, logout, and password-change invalidating old tokens.
* Added a 'test' CI job with a mongo:7 service container running
  cargo test --all-targets.
* Synced scripts/test-ci-locally.sh: fixed the stale -D warnings (CI is
  non-strict) and the reverted 'Docker Buildx' claims; added unit + integration
  test steps with a Mongo skip note.

Verified: cargo fmt --check clean, build + clippy --all-targets clean.
Full 'cargo test': 18 unit + 9 auth + 4 medication = 31 passed, 0 failed
(integration tests skip cleanly when MongoDB is unreachable).

backend/src/app.rs

@@ -0,0 +1,104 @@
+//! Router assembly. Extracted from `main.rs` so integration tests can build the
+//! exact same app (routes, middleware, layers) in process against a test
+//! database instead of a live server.
+
+use axum::{
+    routing::{delete, get, post, put},
+    Router,
+};
+use tower::ServiceBuilder;
+use tower_http::{cors::CorsLayer, trace::TraceLayer};
+
+use crate::config::AppState;
+use crate::handlers;
+use crate::middleware;
+
+/// Compose the full Axum app: all public + protected routes, the JWT auth
+/// layer on protected routes, and the global middleware stack (client-IP
+/// resolution, security headers, rate limit, tracing, CORS).
+///
+/// `main.rs` calls this and wraps it in `into_make_service_with_connect_info`
+/// before serving; tests call it and drive it with `oneshot`/`RouterExt`.
+pub fn build_app(state: AppState) -> Router {
+    // Build public routes (no auth required)
+    let public_routes = Router::new()
+        .route(
+            "/health",
+            get(handlers::health_check).head(handlers::health_check),
+        )
+        .route("/ready", get(handlers::ready_check))
+        .route("/api/auth/register", post(handlers::register))
+        .route("/api/auth/login", post(handlers::login))
+        .route("/api/auth/refresh", post(handlers::refresh))
+        .route("/api/auth/logout", post(handlers::logout))
+        .route(
+            "/api/auth/recover-password",
+            post(handlers::recover_password),
+        );
+
+    // Build protected routes (auth required)
+    let protected_routes = Router::new()
+        // User profile management
+        .route("/api/users/me", get(handlers::get_profile))
+        .route("/api/users/me", put(handlers::update_profile))
+        .route("/api/users/me", delete(handlers::delete_account))
+        .route("/api/users/me/change-password", post(handlers::change_password))
+        // User settings
+        .route("/api/users/me/settings", get(handlers::get_settings))
+        .route("/api/users/me/settings", put(handlers::update_settings))
+        // Share management
+        .route("/api/shares", post(handlers::create_share))
+        .route("/api/shares", get(handlers::list_shares))
+        .route("/api/shares/:id", put(handlers::update_share))
+        .route("/api/shares/:id", delete(handlers::delete_share))
+        // Permission checking
+        .route("/api/permissions/check", post(handlers::check_permission))
+        // Session management (Phase 2.6)
+        .route("/api/sessions", get(handlers::get_sessions))
+        .route("/api/sessions/:id", delete(handlers::revoke_session))
+        .route("/api/sessions/all", delete(handlers::revoke_all_sessions))
+        // Medication management (Phase 2.7)
+        .route("/api/medications", post(handlers::create_medication))
+        .route("/api/medications", get(handlers::list_medications))
+        .route("/api/medications/:id", get(handlers::get_medication))
+        .route("/api/medications/:id", post(handlers::update_medication))
+        .route("/api/medications/:id/delete", post(handlers::delete_medication))
+        .route("/api/medications/:id/log", post(handlers::log_dose))
+        .route("/api/medications/:id/adherence", get(handlers::get_adherence))
+        // Health statistics management (Phase 2.7)
+        .route("/api/health-stats", post(handlers::create_health_stat))
+        .route("/api/health-stats", get(handlers::list_health_stats))
+        .route("/api/health-stats/trends", get(handlers::get_health_trends))
+        .route("/api/health-stats/:id", get(handlers::get_health_stat))
+        .route("/api/health-stats/:id", put(handlers::update_health_stat))
+        .route("/api/health-stats/:id", delete(handlers::delete_health_stat))
+        // Drug interactions (Phase 2.8)
+        .route("/api/interactions/check", post(handlers::check_interactions))
+        .route("/api/interactions/check-new", post(handlers::check_new_medication))
+        .layer(axum::middleware::from_fn_with_state(
+            state.clone(),
+            middleware::jwt_auth_middleware,
+        ));
+
+    public_routes
+        .merge(protected_routes)
+        .with_state(state)
+        .layer(
+            ServiceBuilder::new()
+                // Resolve the client IP once and stash it for handlers/middleware
+                // (audit logging, account-lockout forensics).
+                .layer(axum::middleware::from_fn(
+                    middleware::client_ip_middleware,
+                ))
+                // Security headers (applies to all responses)
+                .layer(axum::middleware::from_fn(
+                    middleware::security_headers_middleware,
+                ))
+                // General rate limiting (currently a stub)
+                .layer(axum::middleware::from_fn(
+                    middleware::general_rate_limit_middleware,
+                ))
+                .layer(TraceLayer::new_for_http())
+                .layer(CorsLayer::permissive()),
+        )
+}