feat: initial commit — backend API + student cabinet frontend

- Go backend: auth (JWT), points earn/spend, QR token generation,
  partners, admin grant/stats endpoints with chi router
- Next.js 14 frontend: login, student dashboard, transaction history,
  QR display, partners list
- PostgreSQL migrations (4 tables), Redis cache, Docker Compose
- CORS middleware, role-based route protection, Zustand auth store

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/internal/partners/handler.go

@@ -0,0 +1,35 @@
+// Package partners handles the public partner listing endpoint.
+package partners
+
+import (
+	"log/slog"
+	"net/http"
+
+	"github.com/cu-points/backend/pkg/response"
+)
+
+// Handler holds HTTP handler methods for the partners domain.
+type Handler struct {
+	service *Service
+}
+
+// NewHandler creates a new partners Handler.
+func NewHandler(service *Service) *Handler {
+	return &Handler{service: service}
+}
+
+// List handles GET /api/v1/partners.
+// Returns all active partners. This endpoint is publicly accessible (no auth required).
+func (h *Handler) List(w http.ResponseWriter, r *http.Request) {
+	partners, err := h.service.ListActive(r.Context())
+	if err != nil {
+		slog.Error("handler.List", "err", err)
+		response.Error(w, http.StatusInternalServerError, "internal server error")
+		return
+	}
+	// Return an empty array rather than null when there are no partners.
+	if partners == nil {
+		partners = []Partner{}
+	}
+	response.JSON(w, http.StatusOK, partners)
+}

backend/internal/partners/repository.go

@@ -0,0 +1,86 @@
+package partners
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// ErrNotFound is returned when the requested partner does not exist.
+var ErrNotFound = errors.New("partner not found")
+
+// Repository handles database access for the partners domain.
+type Repository struct {
+	db *pgxpool.Pool
+}
+
+// NewRepository creates a new partners Repository.
+func NewRepository(db *pgxpool.Pool) *Repository {
+	return &Repository{db: db}
+}
+
+// ListActive fetches all partners where is_active = true, ordered alphabetically.
+func (r *Repository) ListActive(ctx context.Context) ([]Partner, error) {
+	rows, err := r.db.Query(ctx,
+		`SELECT id, name, address, max_spend_pct
+		 FROM partners
+		 WHERE is_active = true
+		 ORDER BY name`,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("repository.ListActive: %w", err)
+	}
+	defer rows.Close()
+
+	var ps []Partner
+	for rows.Next() {
+		var p Partner
+		if err := rows.Scan(&p.ID, &p.Name, &p.Address, &p.MaxSpendPct); err != nil {
+			return nil, fmt.Errorf("repository.ListActive: scan: %w", err)
+		}
+		ps = append(ps, p)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("repository.ListActive: rows: %w", err)
+	}
+	return ps, nil
+}
+
+// GetByID fetches a single partner by its primary key.
+// Returns ErrNotFound if no partner exists with that ID.
+func (r *Repository) GetByID(ctx context.Context, id string) (*Partner, error) {
+	var p Partner
+	err := r.db.QueryRow(ctx,
+		`SELECT id, name, address, max_spend_pct
+		 FROM partners WHERE id = $1`,
+		id,
+	).Scan(&p.ID, &p.Name, &p.Address, &p.MaxSpendPct)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, ErrNotFound
+		}
+		return nil, fmt.Errorf("repository.GetByID: %w", err)
+	}
+	return &p, nil
+}
+
+// GetByUserID fetches the partner record associated with the given cashier user account.
+// Returns ErrNotFound if no partner is linked to that user.
+func (r *Repository) GetByUserID(ctx context.Context, userID string) (*Partner, error) {
+	var p Partner
+	err := r.db.QueryRow(ctx,
+		`SELECT id, name, address, max_spend_pct
+		 FROM partners WHERE user_id = $1`,
+		userID,
+	).Scan(&p.ID, &p.Name, &p.Address, &p.MaxSpendPct)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, ErrNotFound
+		}
+		return nil, fmt.Errorf("repository.GetByUserID: %w", err)
+	}
+	return &p, nil
+}

backend/internal/partners/service.go

@@ -0,0 +1,32 @@
+package partners
+
+import "context"
+
+// Service handles business logic for the partners domain.
+type Service struct {
+	repo *Repository
+}
+
+// NewService creates a new partners Service.
+func NewService(repo *Repository) *Service {
+	return &Service{repo: repo}
+}
+
+// Partner represents a participating business.
+type Partner struct {
+	ID          string `json:"id"`
+	Name        string `json:"name"`
+	Address     string `json:"address"`
+	MaxSpendPct int    `json:"max_spend_pct"`
+}
+
+// ListActive returns all partners with is_active = true.
+func (s *Service) ListActive(ctx context.Context) ([]Partner, error) {
+	return s.repo.ListActive(ctx)
+}
+
+// GetByID returns a partner by its primary key.
+// Returns ErrNotFound (from repository) if the partner does not exist.
+func (s *Service) GetByID(ctx context.Context, id string) (*Partner, error) {
+	return s.repo.GetByID(ctx, id)
+}