LINUS ROUND 2: Tests for automation + CRM handlers, fix vet errors

- automation/engine_test.go: 8 tests (cron parser, actions, start/stop)
- handlers/crm_test.go: 6 tests (CRUD + not-found)
- backend/main_test.go: config validation test
- Fixed websocket unreachable code
- Deleted events/kafka.go placeholder

LINUS_EVALUATION_ROUND2.md

@@ -0,0 +1,115 @@
+# Linus Torvalds Evaluation — Round 2
+
+## The Good (Yes, There Is Some)
+
+1. **Dead code GONE** — You actually deleted the Rust service, C runtime, and Kafka stubs. That's +1. Most people just leave it there "in case we need it later." You didn't.
+
+2. **Generic Store[T]** — This is actually decent. One pattern, tested, reusable. Not revolutionary, but competent.
+
+3. **main.go is readable** — 50 lines instead of 324. I can actually see what the fuck the program does without scrolling.
+
+4. **Tests exist** — config 100%, store 76%, middleware 59%, ledger 58%. Not great overall, but at least SOME packages have real tests.
+
+5. **Binary shrank** — 15.5MB → 12MB. Less bloat.
+
+---
+
+## The Bad (Linus Is Getting Annoyed)
+
+### 1. ZERO TESTS IN 7 PACKAGES
+
+```
+boc           0.0%
+automation    0.0%   ← CRITICAL: this runs workflows on customer data
+cache         0.0%
+db            0.0%
+email         0.0%   ← sends real emails via Resend
+events        0.0%
+models        0.0%
+websocket     0.0%
+```
+
+**Linus says:** "You have a package called `automation` that executes user-defined workflows — including `send_email`, `webhook`, `update_record` — and you have ZERO tests for it? That's not 'we'll add tests later.' That's 'we don't care if customer data gets corrupted.'"
+
+### 2. `handlers` package: 2.3% coverage
+
+You have 20 handler files with ~2000 lines of HTTP handling logic. Your test coverage is 2.3%. That means 97.7% of your API endpoints are completely untested.
+
+**The CRM handler bug I found earlier** (TEXT[] scanning) would have been caught by a single test. One. You had zero.
+
+### 3. WebSocket is dead code
+
+You removed the unreachable code, but now `HandleWebSocket` just returns 401. The entire `websocket` package is 170 lines of dead code. Either implement JWT validation or delete the package.
+
+**Linus says:** "If it doesn't work, delete it. Don't keep a monument to your unfinished work."
+
+### 4. `events/kafka.go` is still there
+
+You deleted the Rust service but kept `backend/events/kafka.go` with `// Kafka integration - placeholder`. Delete it.
+
+### 5. `cache/redis.go` — no tests, no error handling
+
+```go
+func (c *Cache) Get(key string) (string, error) {
+    return c.client.Get(c.ctx, key).Result()
+}
+```
+
+What happens when Redis is down? Every call returns an error that propagates... where? Who handles it?
+
+### 6. `email/resend.go` — sends real emails, zero tests
+
+You call Resend API with customer email addresses. No tests. No validation of the response. No retry logic.
+
+### 7. `db/migrate.go` — runs migrations, zero tests
+
+This modifies your database schema. Zero tests.
+
+---
+
+## The Ugly (Linus Is Yelling Now)
+
+### 8. `main.go` has no test
+
+Your entire application entry point — the thing that wires everything together — has zero tests. You can't even verify it starts correctly.
+
+### 9. Frontend is still 12 HTML files
+
+You wrote a proposal for a SPA refactor. You didn't do it. The frontend is still 12 separate HTML files with duplicated sidebar code.
+
+**Linus says:** "A proposal is not code. I don't merge proposals."
+
+### 10. No integration tests
+
+You deleted the broken integration tests and didn't replace them. Now you have NO tests that verify the full stack works together.
+
+---
+
+## Linus Verdict: 3/10
+
+| Criterion | Status | Notes |
+|-----------|--------|-------|
+| No hardcoded secrets | ✅ PASS | JWT_SECRET required |
+| No dead code | ⚠️ PARTIAL | websocket, kafka.go still there |
+| Tests for critical paths | ❌ FAIL | automation, email, handlers untested |
+| Tests for financial flows | ❌ FAIL | ConvertToOrder, ProcessPayroll untested |
+| Single schema source | ✅ PASS | migrations only |
+| Build passes | ✅ PASS | vet clean |
+| No unreachable code | ✅ PASS | fixed |
+
+**What Linus wants to see:**
+
+1. **Tests for `automation` package** — at minimum, test the cron parser and action execution
+2. **Tests for `handlers` package** — pick the 5 most critical endpoints, test them with sqlmock
+3. **Delete `websocket` package** or implement it properly
+4. **Delete `events/kafka.go`**
+5. **One integration test** — start the server, hit /health, verify it responds
+6. **Frontend SPA** — stop writing proposals, start writing HTML/JS
+
+---
+
+## The Challenge
+
+> "You have 2 hours. Write tests that would have caught the CRM TEXT[] bug, the JWT bypass, and the automation cron misparse. If you can't test your own code, you don't understand it. And if you don't understand it, you shouldn't ship it."
+
+— Linus