Implement security hardening, notification pipeline, and CI test suite

Security hardening:

- Added IP/user rate limiting with Redis-backed counters and fail-open behavior.

- Added message anti-spam controls (per-chat rate + duplicate cooldown).

- Implemented refresh token rotation with JTI tracking and revoke support.

Notification pipeline:

- Added Celery app and async notification tasks for mention/offline delivery.

- Added Redis-based presence tracking and integrated it into realtime connect/disconnect.

- Added notification dispatch from message flow and notifications listing endpoint.

Quality gates and CI:

- Added pytest async integration tests for auth and chat/message lifecycle.

- Added pytest config, test fixtures, and GitHub Actions CI workflow.

- Fixed bcrypt/passlib compatibility by pinning bcrypt version.

- Documented worker and quality-gate commands in README.

app/realtime/service.py

@@ -12,6 +12,7 @@ from app.chats.service import ensure_chat_membership
 from app.messages.schemas import MessageCreateRequest, MessageRead
 from app.messages.service import create_chat_message
 from app.realtime.models import ConnectionContext
+from app.realtime.presence import mark_user_offline, mark_user_online
 from app.realtime.repository import RedisRealtimeRepository
 from app.realtime.schemas import ChatEventPayload, MessageStatusPayload, OutgoingRealtimeEvent, SendMessagePayload
 
@@ -51,6 +52,7 @@ class RealtimeGateway:
         )
         for chat_id in user_chat_ids:
             self._chat_subscribers[chat_id].add(user_id)
+        await mark_user_online(user_id)
         await self._send_user_event(
             user_id,
             OutgoingRealtimeEvent(
@@ -73,6 +75,7 @@ class RealtimeGateway:
                 subscribers.discard(user_id)
                 if not subscribers:
                     self._chat_subscribers.pop(chat_id, None)
+            await mark_user_offline(user_id)
 
     async def handle_send_message(self, db: AsyncSession, user_id: int, payload: SendMessagePayload) -> None:
         message = await create_chat_message(
@@ -164,6 +167,7 @@ class RealtimeGateway:
                 subscribers.discard(user_id)
                 if not subscribers:
                     self._chat_subscribers.pop(chat_id, None)
+            await mark_user_offline(user_id)
 
     @staticmethod
     def _extract_chat_id(channel: str) -> int | None: