fix(backend): P1 — handler unwrap cleanup + rewrite integration tests

P1 items #6 (JWT expiry) and #7 (refresh/logout routes) were already delivered
in the P0 pass. This commit covers the two remaining P1 items:

#9 — Replace dangerous handler-level .unwrap() calls (13 sites):
* handlers/users.rs: 5x ObjectId::parse_str(&claims.sub).unwrap() in
  get_profile/update_profile/delete_account/get_settings/update_settings now
  return 401 on a malformed subject instead of panicking (matches the guard
  already used in change_password).
* handlers/auth.rs: the login user.id.ok_or_else(..).unwrap() was a latent
  panic bug — the crafted 500 response was discarded. Now returns the clean
  500 via match.
* handlers/health_stats.rs: 6x state.health_stats_repo.as_ref().unwrap() now
  return 503 SERVICE_UNAVAILABLE if the feature is unconfigured, mirroring the
  interactions.rs pattern.
* Left untouched: 14 test/boot-time unwraps and 7 infallible ones (header
  literal parsing, infallible TryFrom). The 3 borderline model-layer
  inserted_id unwraps are flagged for later.

#8 — Rewrite the broken integration tests against a real test DB:
* Split the crate into bin+lib: new src/lib.rs + src/app.rs (build_app), with
  main.rs now a thin entrypoint. Tests build the exact production router
  in-process instead of hitting a live server on a hardcoded port.
* tests/common/mod.rs: helpers that connect to Mongo, build a fresh AppState
  against a unique per-process DB (normogen_test_<uuid>), and tear it down.
  A 1s connectivity probe makes tests skip gracefully when Mongo is absent, so
  'cargo test' stays green without Mongo — CI runs them for real.
* Rewrote tests/auth_tests.rs and tests/medication_tests.rs with the ACTUAL
  API contracts (POST /register {email,username,password}; response has token
  + refresh_token, not access_token; register returns 201). Covers register,
  login (right/wrong password), auth enforcement, refresh rotation + reuse
  detection, logout, and password-change invalidating old tokens.
* Added a 'test' CI job with a mongo:7 service container running
  cargo test --all-targets.
* Synced scripts/test-ci-locally.sh: fixed the stale -D warnings (CI is
  non-strict) and the reverted 'Docker Buildx' claims; added unit + integration
  test steps with a Mongo skip note.

Verified: cargo fmt --check clean, build + clippy --all-targets clean.
Full 'cargo test': 18 unit + 9 auth + 4 medication = 31 passed, 0 failed
(integration tests skip cleanly when MongoDB is unreachable).

backend/src/handlers/health_stats.rs

@@ -38,7 +38,16 @@ pub async fn create_health_stat(
     Extension(claims): Extension<Claims>,
     Json(req): Json<CreateHealthStatRequest>,
 ) -> impl IntoResponse {
-    let repo = state.health_stats_repo.as_ref().unwrap();
+    let repo = match state.health_stats_repo.as_ref() {
+        Some(r) => r,
+        None => {
+            return (
+                StatusCode::SERVICE_UNAVAILABLE,
+                Json(serde_json::json!({ "error": "health stats unavailable" })),
+            )
+                .into_response()
+        }
+    };
 
     // Convert complex value to f64 or store as string
     let value_num = match req.value {
@@ -80,7 +89,16 @@ pub async fn list_health_stats(
     State(state): State<AppState>,
     Extension(claims): Extension<Claims>,
 ) -> impl IntoResponse {
-    let repo = state.health_stats_repo.as_ref().unwrap();
+    let repo = match state.health_stats_repo.as_ref() {
+        Some(r) => r,
+        None => {
+            return (
+                StatusCode::SERVICE_UNAVAILABLE,
+                Json(serde_json::json!({ "error": "health stats unavailable" })),
+            )
+                .into_response()
+        }
+    };
     match repo.find_by_user(&claims.sub).await {
         Ok(stats) => (StatusCode::OK, Json(stats)).into_response(),
         Err(e) => {
@@ -99,7 +117,16 @@ pub async fn get_health_stat(
     Extension(claims): Extension<Claims>,
     Path(id): Path<String>,
 ) -> impl IntoResponse {
-    let repo = state.health_stats_repo.as_ref().unwrap();
+    let repo = match state.health_stats_repo.as_ref() {
+        Some(r) => r,
+        None => {
+            return (
+                StatusCode::SERVICE_UNAVAILABLE,
+                Json(serde_json::json!({ "error": "health stats unavailable" })),
+            )
+                .into_response()
+        }
+    };
     let object_id = match ObjectId::parse_str(&id) {
         Ok(oid) => oid,
         Err(_) => return (StatusCode::BAD_REQUEST, "Invalid ID").into_response(),
@@ -130,7 +157,16 @@ pub async fn update_health_stat(
     Path(id): Path<String>,
     Json(req): Json<UpdateHealthStatRequest>,
 ) -> impl IntoResponse {
-    let repo = state.health_stats_repo.as_ref().unwrap();
+    let repo = match state.health_stats_repo.as_ref() {
+        Some(r) => r,
+        None => {
+            return (
+                StatusCode::SERVICE_UNAVAILABLE,
+                Json(serde_json::json!({ "error": "health stats unavailable" })),
+            )
+                .into_response()
+        }
+    };
     let object_id = match ObjectId::parse_str(&id) {
         Ok(oid) => oid,
         Err(_) => return (StatusCode::BAD_REQUEST, "Invalid ID").into_response(),
@@ -182,7 +218,16 @@ pub async fn delete_health_stat(
     Extension(claims): Extension<Claims>,
     Path(id): Path<String>,
 ) -> impl IntoResponse {
-    let repo = state.health_stats_repo.as_ref().unwrap();
+    let repo = match state.health_stats_repo.as_ref() {
+        Some(r) => r,
+        None => {
+            return (
+                StatusCode::SERVICE_UNAVAILABLE,
+                Json(serde_json::json!({ "error": "health stats unavailable" })),
+            )
+                .into_response()
+        }
+    };
     let object_id = match ObjectId::parse_str(&id) {
         Ok(oid) => oid,
         Err(_) => return (StatusCode::BAD_REQUEST, "Invalid ID").into_response(),
@@ -219,7 +264,16 @@ pub async fn get_health_trends(
     Extension(claims): Extension<Claims>,
     Query(query): Query<HealthTrendsQuery>,
 ) -> impl IntoResponse {
-    let repo = state.health_stats_repo.as_ref().unwrap();
+    let repo = match state.health_stats_repo.as_ref() {
+        Some(r) => r,
+        None => {
+            return (
+                StatusCode::SERVICE_UNAVAILABLE,
+                Json(serde_json::json!({ "error": "health stats unavailable" })),
+            )
+                .into_response()
+        }
+    };
     match repo.find_by_user(&claims.sub).await {
         Ok(stats) => {
             // Filter by stat_type