LINUS ROUND 1: Delete dead code (rust/c), generic Store[T], tests, slim main.go

- Removed rust-service/, c-runtime/, kafka stubs
- Generic Store[T] pattern with real tests
- Slimmed main.go from 324 to ~50 lines
- Added config, middleware, store, ledger, pdf tests
- Frontend SPA shell with router
- Binary: 15.5MB -> 12MB

backend/middleware/auth_test.go

@@ -0,0 +1,104 @@
+package middleware
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/stretchr/testify/assert"
+
+	"boc/config"
+	"boc/handlers"
+)
+
+func generateTestToken(secret string) string {
+	claims := handlers.Claims{
+		UserID: "test-user",
+		Email:  "test@example.com",
+		Role:   "admin",
+		RegisteredClaims: jwt.RegisteredClaims{
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Hour)),
+		},
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	signed, _ := token.SignedString([]byte(secret))
+	return signed
+}
+
+func TestAuth_ValidToken(t *testing.T) {
+	secret := "test-secret"
+	cfg := &config.Config{JWTSecret: secret}
+	token := generateTestToken(secret)
+
+	handler := Auth(cfg)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		claims, ok := r.Context().Value("user").(*handlers.Claims)
+		assert.True(t, ok)
+		assert.Equal(t, "test-user", claims.UserID)
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	req.Header.Set("Authorization", "Bearer "+token)
+	rr := httptest.NewRecorder()
+
+	handler.ServeHTTP(rr, req)
+	assert.Equal(t, http.StatusOK, rr.Code)
+}
+
+func TestAuth_MissingHeader(t *testing.T) {
+	cfg := &config.Config{JWTSecret: "test-secret"}
+	handler := Auth(cfg)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		t.Fatal("should not reach handler")
+	}))
+
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	rr := httptest.NewRecorder()
+
+	handler.ServeHTTP(rr, req)
+	assert.Equal(t, http.StatusUnauthorized, rr.Code)
+}
+
+func TestAuth_InvalidFormat(t *testing.T) {
+	cfg := &config.Config{JWTSecret: "test-secret"}
+	handler := Auth(cfg)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		t.Fatal("should not reach handler")
+	}))
+
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	req.Header.Set("Authorization", "Basic dXNlcjpwYXNz")
+	rr := httptest.NewRecorder()
+
+	handler.ServeHTTP(rr, req)
+	assert.Equal(t, http.StatusUnauthorized, rr.Code)
+}
+
+func TestAuth_InvalidToken(t *testing.T) {
+	cfg := &config.Config{JWTSecret: "test-secret"}
+	handler := Auth(cfg)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		t.Fatal("should not reach handler")
+	}))
+
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	req.Header.Set("Authorization", "Bearer invalid-token")
+	rr := httptest.NewRecorder()
+
+	handler.ServeHTTP(rr, req)
+	assert.Equal(t, http.StatusUnauthorized, rr.Code)
+}
+
+func TestAuth_WrongSecret(t *testing.T) {
+	token := generateTestToken("wrong-secret")
+	cfg := &config.Config{JWTSecret: "correct-secret"}
+	handler := Auth(cfg)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		t.Fatal("should not reach handler")
+	}))
+
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	req.Header.Set("Authorization", "Bearer "+token)
+	rr := httptest.NewRecorder()
+
+	handler.ServeHTTP(rr, req)
+	assert.Equal(t, http.StatusUnauthorized, rr.Code)
+}