pgx v5 uses binary protocol for timestamptz and cannot scan it
directly into *string. Scan into time.Time and format as RFC3339.
Fixes /admin/users internal server error and broken grant search.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Partner flow: QR scanner component (html5-qrcode) with camera
permission/not-found handling, 3-step spend flow (scan → amount
entry with auto-filled max → success/error result).
Admin dashboard: stats overview, grant points with debounced
student search, paginated transactions table with type filters,
paginated students table.
Tests: comprehensive unit tests for points and auth packages —
service (all paths including error branches, RS256 wrong-method),
handler (all HTTP status codes via httptest), JWT round-trip,
repository constructors. Auth coverage: 72.9%, points service
coverage: 100%.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>