test(auth): add referral code case-insensitivity tests

Tests lowercase, uppercase, mixed case, and all caps referral codes against a lowercase stored code. All 4 sub-tests pass, confirming the strings.ToLower fix in RegisterHandler.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

backend/handlers/auth/auth_test.go

@@ -1107,6 +1107,82 @@ func TestRegister_WithInvalidReferralCodeFormat(t *testing.T) {
 	}
 }
 
+// TestRegister_ReferralCodeCaseInsensitive verifies that referral codes with
+// uppercase letters are accepted and correctly matched against lowercase stored codes.
+func TestRegister_ReferralCodeCaseInsensitive(t *testing.T) {
+	resetTestData(t)
+
+	handler := http.HandlerFunc(RegisterHandler)
+
+	// Create a referrer user with a known referral code (lowercase hex)
+	referrerID, err := fixtures.CreateTestUserWithEmail(db.DB, "referrer-case@test.com", "verified_email")
+	if err != nil {
+		t.Fatalf("failed to create referrer user: %v", err)
+	}
+	defer fixtures.DeleteUser(db.DB, referrerID)
+
+	knownCode := "abc123def456"
+	_, err = db.DB.Exec(context.Background(),
+		"UPDATE users SET referral_code = $1 WHERE id = $2", knownCode, referrerID)
+	if err != nil {
+		t.Fatalf("failed to set referral code: %v", err)
+	}
+
+	tests := []struct {
+		name       string
+		inputCode  string
+		wantStatus int
+	}{
+		{"lowercase", "abc123def456", http.StatusCreated},
+		{"uppercase", "ABC123DEF456", http.StatusCreated},
+		{"mixed_case", "AbC123DeF456", http.StatusCreated},
+		{"all_caps", "ABC123DEF456", http.StatusCreated},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			body := RegisterRequest{
+				FirstName:      "Case",
+				LastName:       "Test",
+				Email:          fmt.Sprintf("case-test-%s@test.com", tt.name),
+				Password:       "password123",
+				Phone:          "07123456789",
+				DateOfBirth:    "1990-01-15",
+				AgreedToPolicy: true,
+				ReferralCode:   tt.inputCode,
+			}
+
+			w := makeRequest(handler, "POST", "/api/register", body)
+
+			if w.Code != tt.wantStatus {
+				t.Errorf("%s: expected status %d, got %d. body: %s", tt.name, tt.wantStatus, w.Code, w.Body.String())
+			}
+
+			if tt.wantStatus == http.StatusCreated {
+				// Verify referral relationship was created
+				var referredID string
+				err = db.DB.QueryRow(context.Background(),
+					"SELECT id FROM users WHERE email = $1", fmt.Sprintf("case-test-%s@test.com", tt.name)).Scan(&referredID)
+				if err != nil {
+					t.Fatalf("%s: failed to find referred user: %v", tt.name, err)
+				}
+				defer fixtures.DeleteUser(db.DB, referredID)
+
+				var count int
+				err = db.DB.QueryRow(context.Background(),
+					"SELECT COUNT(*) FROM user_referrals WHERE referrer_id = $1 AND referred_id = $2",
+					referrerID, referredID).Scan(&count)
+				if err != nil {
+					t.Fatalf("%s: failed to query user_referrals: %v", tt.name, err)
+				}
+				if count != 1 {
+					t.Errorf("%s: expected 1 referral record, got %d", tt.name, count)
+				}
+			}
+		})
+	}
+}
+
 // =============================================================================
 // Logout Handler Tests
 // =============================================================================