fix: enforce minimum strength for learning-path tokens (issue #1874)

[ionfwsrijan]

Problem

The learning-path APIs used the client-chosen X-Learning-Path-Token as the only authorization secret but accepted any non-empty token. The route docstring only advised callers to use "a random UUID or similar"; there was no server-side length/entropy requirement, so trivially guessable tokens (e.g. "test", "1234") gave full read/write access to a user's learning-path state.

Fix

• Enforce a minimum token length of 16 characters in _validate_token (src/utils/learning_path.py). Since create_learning_path, get_learning_path, and update_learning_path all validate the token, every learning-path route (create/read/update/analytics) now rejects weak tokens with HTTP 400 via the existing ValueError handling — no per-route changes needed.
• Updated the create/read/update/analytics route docstrings to document that the token must be at least 16 characters (a random UUID or equivalent high-entropy value) and that short tokens are rejected.

Files changed

• src/utils/learning_path.py — _MIN_TOKEN_LENGTH = 16; _validate_token rejects tokens shorter than 16 characters with a clear message.
• src/routes/main_routes.py — docstrings for the four learning-path endpoints now state the enforced requirement (was advisory only).
• tests/test_learning_path.py — new TestWeakTokenRejection class with route-level tests asserting weak tokens on POST/GET/PUT return 400.

Testing

• Isolated test run of tests/test_learning_path.py (minimal app stub since app cannot import locally due to the pre-existing App fails to boot: NameError: name 're' is not defined in portfolio_analyzer.py #1810) — 52 passed (48 existing + 4 new).
• Existing tests continue to pass because the test token helper secrets.token_urlsafe(32) produces 43-character tokens.

Closes #1874

[vercel]

@ionfwsrijan is attempting to deploy a commit to the komalsony234-1530's projects Team on Vercel.

A member of the Team first needs to authorize it.