Implement security hardening, notification pipeline, and CI test suite

Security hardening:

- Added IP/user rate limiting with Redis-backed counters and fail-open behavior.

- Added message anti-spam controls (per-chat rate + duplicate cooldown).

- Implemented refresh token rotation with JTI tracking and revoke support.

Notification pipeline:

- Added Celery app and async notification tasks for mention/offline delivery.

- Added Redis-based presence tracking and integrated it into realtime connect/disconnect.

- Added notification dispatch from message flow and notifications listing endpoint.

Quality gates and CI:

- Added pytest async integration tests for auth and chat/message lifecycle.

- Added pytest config, test fixtures, and GitHub Actions CI workflow.

- Fixed bcrypt/passlib compatibility by pinning bcrypt version.

- Documented worker and quality-gate commands in README.

app/realtime/presence.py

@@ -0,0 +1,34 @@
+from redis.exceptions import RedisError
+
+from app.utils.redis_client import get_redis_client
+
+
+async def mark_user_online(user_id: int) -> None:
+    try:
+        redis = get_redis_client()
+        key = f"presence:user:{user_id}"
+        count = await redis.incr(key)
+        if count == 1:
+            await redis.expire(key, 3600)
+    except RedisError:
+        return
+
+
+async def mark_user_offline(user_id: int) -> None:
+    try:
+        redis = get_redis_client()
+        key = f"presence:user:{user_id}"
+        value = await redis.decr(key)
+        if value <= 0:
+            await redis.delete(key)
+    except RedisError:
+        return
+
+
+async def is_user_online(user_id: int) -> bool:
+    try:
+        redis = get_redis_client()
+        value = await redis.get(f"presence:user:{user_id}")
+        return bool(value and str(value).isdigit() and int(value) > 0)
+    except RedisError:
+        return False