feat(backend): implement HTTP API, auth, chat, and admin surfaces

Expose learning, registration controls, mentor chat, realtime WebSocket, and staff administration.

backend/internal/api/errors_test.go

@@ -0,0 +1,63 @@
+package api
+
+import (
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestWriteErrIncludesCodeAndRequestID(t *testing.T) {
+	rec := httptest.NewRecorder()
+	rec.Header().Set("X-Request-ID", "abc123deadbeef")
+	writeErr(rec, http.StatusBadRequest, "داده نامعتبر است")
+
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status: %d", rec.Code)
+	}
+	var body apiError
+	if err := json.NewDecoder(rec.Body).Decode(&body); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if body.Error != "داده نامعتبر است" {
+		t.Fatalf("error: %q", body.Error)
+	}
+	if body.Code != CodeBadRequest {
+		t.Fatalf("code: %q", body.Code)
+	}
+	if body.RequestID != "abc123deadbeef" {
+		t.Fatalf("requestId: %q", body.RequestID)
+	}
+}
+
+func TestWriteErrCodeLocked(t *testing.T) {
+	rec := httptest.NewRecorder()
+	writeErrCode(rec, http.StatusLocked, CodeLocked, "حساب محدود شده است")
+	var body apiError
+	if err := json.NewDecoder(rec.Body).Decode(&body); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if body.Code != CodeLocked {
+		t.Fatalf("code: %q", body.Code)
+	}
+}
+
+func TestWriteInternalErrHidesCause(t *testing.T) {
+	rec := httptest.NewRecorder()
+	writeInternalErr(rec, "test.op", errors.New("secret db detail"), "عملیات ممکن نشد")
+	var body apiError
+	if err := json.NewDecoder(rec.Body).Decode(&body); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if body.Code != CodeInternal {
+		t.Fatalf("code: %q", body.Code)
+	}
+	if body.Error != "عملیات ممکن نشد" {
+		t.Fatalf("error: %q", body.Error)
+	}
+	if strings.Contains(rec.Body.String(), "secret") {
+		t.Fatalf("leaked internal detail: %s", rec.Body.String())
+	}
+}