Coverage priorities 1-5: test pure functions, extract interfaces, mock-based handler tests

- Priority 1: Test NewSendEmailTask + NewSendPushTask (5 tests)
- Priority 2: Test customHTTPErrorHandler — all 15+ branches (21 tests)
- Priority 3: Extract Enqueuer interface + payload builders in worker pkg (5 tests)
- Priority 4: Extract ClassifyFile/ComputeRelPath in migrate-encrypt (6 tests)
- Priority 5: Define Handler interfaces, refactor to accept them, mock-based tests (14 tests)
- Fix .gitignore: /worker instead of worker to stop ignoring internal/worker/

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

cmd/migrate-encrypt/main.go

@@ -13,7 +13,6 @@ import (
 	"flag"
 	"os"
 	"path/filepath"
-	"strings"
 	"time"
 
 	"github.com/rs/zerolog"
@@ -87,13 +86,11 @@ func main() {
 			return nil
 		}
 
-		// Skip directories
-		if info.IsDir() {
+		action := ClassifyFile(info.IsDir(), path, *dryRun)
+		switch action {
+		case ActionSkipDir:
 			return nil
-		}
-
-		// Skip files already encrypted
-		if strings.HasSuffix(path, ".enc") {
+		case ActionSkipEncrypted:
 			skipped++
 			return nil
 		}
@@ -101,14 +98,14 @@ func main() {
 		totalFiles++
 
 		// Compute the relative path from upload dir
-		relPath, err := filepath.Rel(absUploadDir, path)
+		relPath, err := ComputeRelPath(absUploadDir, path)
 		if err != nil {
 			log.Warn().Err(err).Str("path", path).Msg("Failed to compute relative path")
 			errCount++
 			return nil
 		}
 
-		if *dryRun {
+		if action == ActionDryRun {
 			log.Info().Str("file", relPath).Msg("[DRY RUN] Would encrypt")
 			return nil
 		}