fix(backend): P1 — handler unwrap cleanup + rewrite integration tests

P1 items #6 (JWT expiry) and #7 (refresh/logout routes) were already delivered
in the P0 pass. This commit covers the two remaining P1 items:

#9 — Replace dangerous handler-level .unwrap() calls (13 sites):
* handlers/users.rs: 5x ObjectId::parse_str(&claims.sub).unwrap() in
  get_profile/update_profile/delete_account/get_settings/update_settings now
  return 401 on a malformed subject instead of panicking (matches the guard
  already used in change_password).
* handlers/auth.rs: the login user.id.ok_or_else(..).unwrap() was a latent
  panic bug — the crafted 500 response was discarded. Now returns the clean
  500 via match.
* handlers/health_stats.rs: 6x state.health_stats_repo.as_ref().unwrap() now
  return 503 SERVICE_UNAVAILABLE if the feature is unconfigured, mirroring the
  interactions.rs pattern.
* Left untouched: 14 test/boot-time unwraps and 7 infallible ones (header
  literal parsing, infallible TryFrom). The 3 borderline model-layer
  inserted_id unwraps are flagged for later.

#8 — Rewrite the broken integration tests against a real test DB:
* Split the crate into bin+lib: new src/lib.rs + src/app.rs (build_app), with
  main.rs now a thin entrypoint. Tests build the exact production router
  in-process instead of hitting a live server on a hardcoded port.
* tests/common/mod.rs: helpers that connect to Mongo, build a fresh AppState
  against a unique per-process DB (normogen_test_<uuid>), and tear it down.
  A 1s connectivity probe makes tests skip gracefully when Mongo is absent, so
  'cargo test' stays green without Mongo — CI runs them for real.
* Rewrote tests/auth_tests.rs and tests/medication_tests.rs with the ACTUAL
  API contracts (POST /register {email,username,password}; response has token
  + refresh_token, not access_token; register returns 201). Covers register,
  login (right/wrong password), auth enforcement, refresh rotation + reuse
  detection, logout, and password-change invalidating old tokens.
* Added a 'test' CI job with a mongo:7 service container running
  cargo test --all-targets.
* Synced scripts/test-ci-locally.sh: fixed the stale -D warnings (CI is
  non-strict) and the reverted 'Docker Buildx' claims; added unit + integration
  test steps with a Mongo skip note.

Verified: cargo fmt --check clean, build + clippy --all-targets clean.
Full 'cargo test': 18 unit + 9 auth + 4 medication = 31 passed, 0 failed
(integration tests skip cleanly when MongoDB is unreachable).

scripts/test-ci-locally.sh

@@ -25,10 +25,11 @@ fi
 echo ""
 
 # Test 2: Clippy
+# NOTE: matches CI (non-strict — warnings shown but don't fail the build).
 echo "🔍 Test 2: Clippy Lint"
-echo "Command: cargo clippy --all-targets --all-features -- -D warnings"
-if cargo clippy --all-targets --all-features -- -D warnings; then
-    echo "✅ PASS - No clippy warnings"
+echo "Command: cargo clippy --all-targets --all-features"
+if cargo clippy --all-targets --all-features; then
+    echo "✅ PASS - Clippy clean"
 else
     echo "❌ FAIL - Clippy found issues"
     exit 1
@@ -59,23 +60,42 @@ else
 fi
 echo ""
 
-# Test 5: Docker build (only if Docker is available locally)
+# Test 5: Unit tests (always run; no external dependencies).
+echo "🔍 Test 5: Unit Tests"
+echo "Command: cargo test --lib --bins"
+if cargo test --lib --bins; then
+    echo "✅ PASS - Unit tests pass"
+else
+    echo "❌ FAIL - Unit tests failed"
+    exit 1
+fi
+echo ""
+
+# Test 6: Integration tests (need a live MongoDB; skip gracefully without one).
+echo "🔍 Test 6: Integration Tests"
+echo "Command: cargo test --test auth_tests --test medication_tests"
+echo "  (these skip automatically if MongoDB is not reachable)"
+echo "  To run for real: docker run -d -p 27017:27017 --name mongo-test mongo:7"
+if cargo test --test auth_tests --test medication_tests; then
+    echo "✅ PASS - Integration tests pass (or skipped: no MongoDB)"
+else
+    echo "❌ FAIL - Integration tests failed"
+    exit 1
+fi
+echo ""
+
+# Note: Docker images are built separately (Forgejo CI cannot run DinD due to
+# network isolation). Build locally with: docker build -f docker/Dockerfile .
 if command -v docker &> /dev/null && docker info &> /dev/null; then
-    echo "🔍 Test 5: Docker Build"
+    echo "🔍 Optional: Docker Build"
     echo "Command: docker build -f docker/Dockerfile -t normogen-backend:test ."
     if docker build -f docker/Dockerfile -t normogen-backend:test .; then
         echo "✅ PASS - Docker image built"
         docker images normogen-backend:test
     else
-        echo "❌ FAIL - Docker build failed"
-        exit 1
+        echo "⚠️  Docker build failed (non-fatal; CI does not build Docker either)"
     fi
     echo ""
-else
-    echo "⚠️  SKIP - Docker not available locally"
-    echo "   Note: Docker build will run in Forgejo CI on Solaria"
-    echo "   This is expected and OK!"
-    echo ""
 fi
 
 echo "=========================================="
@@ -87,14 +107,16 @@ echo "  ✅ Code formatting"
 echo "  ✅ Clippy linting"
 echo "  ✅ Build successful"
 echo "  ✅ Binary created"
+echo "  ✅ Unit tests pass"
+echo "  ✅ Integration tests pass (or skipped without MongoDB)"
 echo ""
 echo "Next steps:"
 echo "  1. Commit the changes"
 echo "  2. Push to Forgejo"
 echo "  3. Watch CI run at: http://gitea.solivarez.com.ar/alvaro/normogen/actions"
 echo ""
-echo "The Forgejo CI will also:"
+echo "The Forgejo CI will:"
 echo "  • Verify formatting (same as local)"
 echo "  • Run Clippy (same as local)"
 echo "  • Build the binary (same as local)"
-echo "  • Build Docker image with Buildx (runs on Solaria)"
+echo "  • Run unit + integration tests (with a MongoDB service container)"