test(api): integration coverage — brevo ledger webhook + thin endpoints (toward 100%)

[mastermanas805]

What

Adds real-DB integration tests for two handlers that previously had only sqlmock (unit) coverage, closing integration gaps flagged in INTEGRATION-COVERAGE-PLAN-2026-06-04 §2.1. No production code changed — test-only additions.

1. POST /webhooks/brevo/:secret — the rule-12 email truth surface

brevo_webhook_realdb_integration_test.go seeds real forwarder_sent rows, POSTs synthetic Brevo events (HMAC-free URL-token auth, same shape Brevo emits), and reads the row back via the production LookupForwarderSentByProviderID helper. Proves the SQL is correct against a real Postgres schema (not merely "issued", which is all the sqlmock suite could assert):

• delivered → overwrites classification + stamps delivered_at.
• each non-delivered event (hard_bounce/soft_bounce/blocked/complaint/spam→complaint/deferred/unsubscribed/error) → its terminal class, delivered_at stays NULL.
• bug-bash feat(api): add GET /api/v1/whoami for agent identity probes #6 terminal-class guard (the feat(api): add GET /api/v1/whoami for agent identity probes #6 guard area the brief calls out): a LATE out-of-order delivered does NOT clobber a recorded bounced_hard/soft/rejected/complaint/unsubscribed, while it DOES upgrade non-terminal deferred/success. This row-state predicate can only be proven against a real row.
• GREATEST(delivered_at, NOW()) is monotonic on Brevo retries (idempotent).
• orphan messageId → 200 no-op, no row created.

Testable today despite the unvalidated-Brevo-sender production block (synthetic payload, not a live send).

2. GET /api/v1/status — public status aggregator

status_realdb_integration_test.go seeds real service_components + uptime_samples and asserts the computed payload through a Fiber app on real DB + real Redis:

• operational (all-healthy) vs down (recent unhealthy probe drives current_status off operational + depresses uptime %).
• empty-DB clean state (ok:true, [] incidents, never 500).
• the 60s cache.GetOrSet round-trip — second request served from Redis (a mid-flight DB mutation stays masked until the cache key is busted).
• nil-Redis DB-fallback path (status page stays up when the cache is degraded).

Integration-coverage delta

Measured with the §1.4 command for internal/handlers (-coverpkg=./..., real local Postgres + Redis):

Scope	Before	After
internal/handlers vs all prod pkgs (./...)	78.6%	78.7%
status.go computeOne	86.0%	89.5%

The brevo handler lines were already line-covered by sqlmock, so the marginal line lift is modest — the value added is behavioral integration coverage of the actual SQL (terminal-class guard, GREATEST monotonicity, idempotency), which line coverage cannot capture but is the rule-12 truth-surface guarantee.

The pre-existing local TestQueue_CredIssueError_FallsBackToLegacyOpen 503 (NATS unreachable locally) is unchanged and unrelated — CI supplies NATS.

🤖 Generated with Claude Code