fix(auth): lowercase referral code before validation and lookup

Defense-in-depth: referral codes are generated as hex (lowercase only) by the DB. The frontend already lowercases on input, but direct API calls with uppercase would fail the DB lookup. Normalize to lowercase on the backend to prevent capslock situations.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

backend/handlers/auth/local.go

@@ -177,7 +177,7 @@ func RegisterHandler(w http.ResponseWriter, r *http.Request) {
 
 	// Validate referral code if provided
 	var referrerID *string
-	req.ReferralCode = strings.TrimSpace(req.ReferralCode)
+	req.ReferralCode = strings.ToLower(strings.TrimSpace(req.ReferralCode))
 	if req.ReferralCode != "" {
 		if len(req.ReferralCode) != 12 {
 			http.Error(w, "referral code must be exactly 12 characters", http.StatusBadRequest)