feat: initial commit — backend API + student cabinet frontend

- Go backend: auth (JWT), points earn/spend, QR token generation,
  partners, admin grant/stats endpoints with chi router
- Next.js 14 frontend: login, student dashboard, transaction history,
  QR display, partners list
- PostgreSQL migrations (4 tables), Redis cache, Docker Compose
- CORS middleware, role-based route protection, Zustand auth store

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/internal/auth/repository.go

@@ -0,0 +1,78 @@
+package auth
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// ErrNotFound is returned when the requested user does not exist in the database.
+var ErrNotFound = errors.New("not found")
+
+// UserRecord is the minimal user row fetched from the database during authentication.
+type UserRecord struct {
+	ID           string
+	Email        string
+	PasswordHash string
+	Role         string
+}
+
+// UserRepository defines the database operations the auth service depends on.
+// Defined as an interface so unit tests can inject a mock without a real database.
+type UserRepository interface {
+	// GetUserByEmail returns the user row for the given email address.
+	// Returns ErrNotFound if no user exists with that email.
+	GetUserByEmail(ctx context.Context, email string) (*UserRecord, error)
+
+	// GetUserByID returns the user row for the given primary key.
+	// Returns ErrNotFound if the user has been deleted since the token was issued.
+	GetUserByID(ctx context.Context, id string) (*UserRecord, error)
+}
+
+// Repository is the PostgreSQL-backed implementation of UserRepository.
+type Repository struct {
+	db *pgxpool.Pool
+}
+
+// NewRepository creates a new PostgreSQL-backed auth Repository.
+func NewRepository(db *pgxpool.Pool) *Repository {
+	return &Repository{db: db}
+}
+
+// GetUserByEmail fetches the user row needed for password verification.
+// Returns ErrNotFound if no user exists with that email.
+func (r *Repository) GetUserByEmail(ctx context.Context, email string) (*UserRecord, error) {
+	var u UserRecord
+	err := r.db.QueryRow(ctx,
+		`SELECT id, email, password_hash, role FROM users WHERE email = $1`,
+		email,
+	).Scan(&u.ID, &u.Email, &u.PasswordHash, &u.Role)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, ErrNotFound
+		}
+		return nil, fmt.Errorf("repository.GetUserByEmail: %w", err)
+	}
+	return &u, nil
+}
+
+// GetUserByID fetches the user row needed when refreshing a token.
+// The role is re-read from the DB so that admin role changes take effect on the next refresh.
+// Returns ErrNotFound if the user has been deleted since the token was issued.
+func (r *Repository) GetUserByID(ctx context.Context, id string) (*UserRecord, error) {
+	var u UserRecord
+	err := r.db.QueryRow(ctx,
+		`SELECT id, email, password_hash, role FROM users WHERE id = $1`,
+		id,
+	).Scan(&u.ID, &u.Email, &u.PasswordHash, &u.Role)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, ErrNotFound
+		}
+		return nil, fmt.Errorf("repository.GetUserByID: %w", err)
+	}
+	return &u, nil
+}