Coverage priorities 1-5: test pure functions, extract interfaces, mock-based handler tests

- Priority 1: Test NewSendEmailTask + NewSendPushTask (5 tests)
- Priority 2: Test customHTTPErrorHandler — all 15+ branches (21 tests)
- Priority 3: Extract Enqueuer interface + payload builders in worker pkg (5 tests)
- Priority 4: Extract ClassifyFile/ComputeRelPath in migrate-encrypt (6 tests)
- Priority 5: Define Handler interfaces, refactor to accept them, mock-based tests (14 tests)
- Fix .gitignore: /worker instead of worker to stop ignoring internal/worker/

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/worker/enqueuer.go

@@ -0,0 +1,44 @@
+package worker
+
+import "encoding/json"
+
+// Enqueuer defines the interface for enqueuing background email tasks.
+type Enqueuer interface {
+	EnqueueWelcomeEmail(to, firstName, code string) error
+	EnqueueVerificationEmail(to, firstName, code string) error
+	EnqueuePasswordResetEmail(to, firstName, code, resetToken string) error
+	EnqueuePasswordChangedEmail(to, firstName string) error
+}
+
+// Verify TaskClient satisfies the interface at compile time.
+var _ Enqueuer = (*TaskClient)(nil)
+
+// BuildWelcomeEmailPayload marshals a WelcomeEmailPayload to JSON bytes.
+func BuildWelcomeEmailPayload(to, firstName, code string) ([]byte, error) {
+	return json.Marshal(WelcomeEmailPayload{
+		EmailPayload:     EmailPayload{To: to, FirstName: firstName},
+		ConfirmationCode: code,
+	})
+}
+
+// BuildVerificationEmailPayload marshals a VerificationEmailPayload to JSON bytes.
+func BuildVerificationEmailPayload(to, firstName, code string) ([]byte, error) {
+	return json.Marshal(VerificationEmailPayload{
+		EmailPayload: EmailPayload{To: to, FirstName: firstName},
+		Code:         code,
+	})
+}
+
+// BuildPasswordResetEmailPayload marshals a PasswordResetEmailPayload to JSON bytes.
+func BuildPasswordResetEmailPayload(to, firstName, code, resetToken string) ([]byte, error) {
+	return json.Marshal(PasswordResetEmailPayload{
+		EmailPayload: EmailPayload{To: to, FirstName: firstName},
+		Code:         code,
+		ResetToken:   resetToken,
+	})
+}
+
+// BuildPasswordChangedEmailPayload marshals an EmailPayload to JSON bytes.
+func BuildPasswordChangedEmailPayload(to, firstName string) ([]byte, error) {
+	return json.Marshal(EmailPayload{To: to, FirstName: firstName})
+}