Coverage priorities 1-5: test pure functions, extract interfaces, mock-based handler tests

- Priority 1: Test NewSendEmailTask + NewSendPushTask (5 tests)
- Priority 2: Test customHTTPErrorHandler — all 15+ branches (21 tests)
- Priority 3: Extract Enqueuer interface + payload builders in worker pkg (5 tests)
- Priority 4: Extract ClassifyFile/ComputeRelPath in migrate-encrypt (6 tests)
- Priority 5: Define Handler interfaces, refactor to accept them, mock-based tests (14 tests)
- Fix .gitignore: /worker instead of worker to stop ignoring internal/worker/

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

cmd/migrate-encrypt/helpers.go

@@ -0,0 +1,50 @@
+package main
+
+import (
+	"path/filepath"
+	"strings"
+)
+
+// isEncrypted checks if a file path ends with .enc
+func isEncrypted(path string) bool {
+	return strings.HasSuffix(path, ".enc")
+}
+
+// encryptedPath appends .enc to the file path.
+func encryptedPath(path string) string {
+	return path + ".enc"
+}
+
+// shouldProcessFile returns true if the file should be encrypted.
+func shouldProcessFile(isDir bool, path string) bool {
+	return !isDir && !isEncrypted(path)
+}
+
+// FileAction represents the decision about what to do with a file during encryption migration.
+type FileAction int
+
+const (
+	ActionSkipDir       FileAction = iota // Directory, skip
+	ActionSkipEncrypted                   // Already encrypted, skip
+	ActionDryRun                          // Would encrypt (dry run mode)
+	ActionEncrypt                         // Should encrypt
+)
+
+// ClassifyFile determines what action to take for a file during the walk.
+func ClassifyFile(isDir bool, path string, dryRun bool) FileAction {
+	if isDir {
+		return ActionSkipDir
+	}
+	if isEncrypted(path) {
+		return ActionSkipEncrypted
+	}
+	if dryRun {
+		return ActionDryRun
+	}
+	return ActionEncrypt
+}
+
+// ComputeRelPath computes the relative path from base to path.
+func ComputeRelPath(base, path string) (string, error) {
+	return filepath.Rel(base, path)
+}