refactor(handlers): migrate remaining backend handlers to clock.Now() and transaction patterns

Apply clock.Now() migration, transaction wrapping, and minor refactors across admin, scheduling, today, user, auth handler, notifications, webhooks, services, portfolio, ratelimit, testutils, and main.go.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

backend/handlers/user/gdpr_export.go

@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"crussell/db"
+	"crussell/clock"
 	"crussell/mw"
 )
 
@@ -28,14 +29,21 @@ func init() {
 		ticker := time.NewTicker(5 * time.Minute)
 		defer ticker.Stop()
 		for range ticker.C {
-			gdprExportCacheMu.Lock()
-			now := time.Now()
-			for k, v := range gdprExportCache {
-				if now.After(v.expiresAt) {
-					delete(gdprExportCache, k)
+			func() {
+				defer func() {
+					if r := recover(); r != nil {
+						log.Printf("Panic recovered in GDPR export cache cleanup ticker: %v", r)
+					}
+				}()
+				gdprExportCacheMu.Lock()
+				now := clock.Now()
+				for k, v := range gdprExportCache {
+					if now.After(v.expiresAt) {
+						delete(gdprExportCache, k)
+					}
 				}
-			}
-			gdprExportCacheMu.Unlock()
+				gdprExportCacheMu.Unlock()
+			}()
 		}
 	}()
 }
@@ -49,16 +57,14 @@ func GetGDPRExportHandler(w http.ResponseWriter, r *http.Request) {
 	}
 
 	gdprExportCacheMu.Lock()
-	if entry, found := gdprExportCache[userID]; found && time.Now().Before(entry.expiresAt) {
+	if entry, found := gdprExportCache[userID]; found && clock.Now().Before(entry.expiresAt) {
 		if entry.generating {
 			gdprExportCacheMu.Unlock()
-			w.Header().Set("Content-Type", "application/json")
 			w.Header().Set("X-Cache", "GENERATING")
 			w.Write([]byte(`{"status":"generating"}`))
 			return
 		}
 		gdprExportCacheMu.Unlock()
-		w.Header().Set("Content-Type", "application/json")
 		w.Header().Set("X-Cache", "HIT")
 		w.Write(entry.data)
 		return
@@ -68,6 +74,11 @@ func GetGDPRExportHandler(w http.ResponseWriter, r *http.Request) {
 	gdprExportCacheMu.Unlock()
 
 	go func() {
+		defer func() {
+			if r := recover(); r != nil {
+				log.Printf("Panic recovered in GDPR export query: %v", r)
+			}
+		}()
 		var result json.RawMessage
 		err := db.Conn.QueryRow(context.Background(), `SELECT export_all_user_data($1)`, userID).Scan(&result)
 		if err != nil {
@@ -81,12 +92,11 @@ func GetGDPRExportHandler(w http.ResponseWriter, r *http.Request) {
 		gdprExportCacheMu.Lock()
 		gdprExportCache[userID] = &gdprCacheEntry{
 			data:      result,
-			expiresAt: time.Now().Add(12 * time.Hour),
+			expiresAt: clock.Now().Add(12 * time.Hour),
 		}
 		gdprExportCacheMu.Unlock()
 	}()
 
-	w.Header().Set("Content-Type", "application/json")
 	w.Header().Set("X-Cache", "MISS")
 	w.Write([]byte(`{"status":"generating"}`))
 }