[Testing] Critical test coverage gaps — repositories, jetstream, OAuth handlers untested

[daviddao]

Review Finding: 4 — MEDIUM

7,000 lines of tests but concentrated in OAuth middleware, lexicon parsing, and config. The most complex, business-critical code is untested:

Package	Risk Level
internal/database/repositories	High — core data layer untested
internal/jetstream	High — real-time data pipeline untested
internal/server	High — OAuth handlers are security-critical
internal/database/migrations	Medium — schema breakage risk
internal/graphql/types	Medium — type mapping edge cases
internal/workers	Low — simple cleanup logic

Fix

Priority test targets:

1. Repository tests — table-driven tests for all CRUD operations
2. OAuth handler tests — full authorization flow, token exchange, refresh, revocation
3. Jetstream consumer tests — mock WebSocket, test event processing and cursor tracking
4. Migration tests — verify up/down migrations work cleanly
5. Integration test — full flow: lexicon → GraphQL schema → query → response

From codebase review §4