Claude-assisted improvements (untested)

- dev auth flow (side-step OAuth)
- db event processing integration tests
- dev scripts (eg Makefile)
- db / test db migration setup scripts.

work-summaries/work-summary-Claude-2026-08-04-1917.md

@@ -0,0 +1,20 @@
+# Work Summary — 2026-08-04 19:17
+
+## Task
+Fix the `RefreshAccessToken` bug surfaced while adding test coverage (see `work-summaries/work-summary-Claude-2026-08-04-1914.md`), per explicit go-ahead.
+
+## Change
+`domains/authentication/auth.go:257`: `RefreshAccessToken` was calling `a.getRefreshTokenForAccessToken(ctx, accessToken)`, where `accessToken` is the function's *empty named return value*, not the `oldAccessToken` parameter it clearly meant to use (both are `string`, so the compiler had nothing to catch). This meant every real (non-dev) token refresh looked up a refresh token for `""` instead of the actual expiring token, always failed, and sent the user back to `/` with a "failed to refresh access token" error instead of transparently refreshing their session.
+
+Fixed by passing `oldAccessToken` instead:
+```go
+refreshToken, tokenType, err := a.getRefreshTokenForAccessToken(ctx, oldAccessToken)
+```
+
+## Verification
+- `go build ./...` clean.
+- `go test ./domains/authentication/... ./domains/accounts/... ./domains/raw_events/...` — all pass, no regressions.
+- No new automated regression test for this specific bug: `RefreshAccessToken` calls `a.TokenSource(...).Token()`, which makes a real network call to Auth0 to redeem the refresh token - not mockable without adding an interface seam around `oauth2.Config`/`oidc.Provider`, which is a larger refactor than this fix warranted. The underlying query helper (`getRefreshTokenForAccessToken`) is already covered indirectly via `domains/authentication/dev_test.go`.
+
+## Follow-ups / not done here
+- If this path matters enough to regression-test end-to-end, it'd need `oauth2.Config`'s token source made injectable/mockable - flagging as a possible future task, not doing it now.