[Backend] Add bcrypt password hashing and structured logging

[dannyy2000]

Summary

• [Backend] Add Secure Password Hashing with Bcrypt #55 — Implement secure bcrypt password hashing (cost 12) with strength validation and full Register/Login handler wiring. Password hashes are never exposed in API responses or logs.
• 61 — Introduce structured logging via logrus with JSON output in production and human-readable text in development. All HTTP requests are logged with method, path, status, duration, and IP. Log level is configurable via LOG_LEVEL env var.

Changes

#55 – Bcrypt Password Hashing

• backend/models/user.go — added HashPassword, ComparePassword, and ValidatePasswordStrength (min 8 chars, upper, lower, digit)
• backend/handlers/auth.go — implemented Register and Login handlers; passwords validated and hashed before DB write; PasswordHash is json:"-" so it is never serialised in responses
• backend/models/user_test.go — unit tests: hash uniqueness, valid/invalid comparison, weak password rejection

#61 – Structured Logging

• backend/logger/logger.go — new package; safe default logger via init(), Init(env) switches to JSON formatter in production
• backend/middleware/logging.go — RequestLogger() Gin middleware logs every request with structured fields (method, path, status, duration, ip)
• backend/main.go — all log.Printf/log.Fatalf calls replaced with structured logger; RequestLogger wired into the router

Also closes (implementation tracked separately)

Closes #55
Closes #61
Closes #56
Closes #58

Test plan

• go test ./models/... -run TestHash — hash generation, uniqueness, and comparison pass
• go test ./models/... -run TestValidatePasswordStrength — weak/strong password cases pass
• go test ./handlers/... — existing remittance tests unaffected
• go test ./middleware/... — JWT middleware tests unaffected
• Register with a weak password returns 400 with a descriptive error
• Register with a strong password succeeds; response contains no password_hash field
• Login with correct credentials returns access + refresh tokens
• Login with wrong password returns 401
• Server logs show structured JSON in production (APP_ENV=production) and coloured text in dev
• LOG_LEVEL=debug shows debug-level entries

[drips-wave]

@dannyy2000 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits