feat(wallet/go): generate Go/chi backend from wallet.candy — TIME-axis schedule + 48/48 hurl green

[koolamusic]

Summary

Phase E2 of the candy alpha plan. Closes alpha criterion 6 (wallet
example with the TIME-axis schedule, generated and eval-green on at
least one target). With #45 (auth/Go), #47 (auth/Rust), and #48
(todo/Go) this completes alpha criteria 3, 4, 5, and 6.

A Go/chi backend generated from `examples/wallet/wallet.candy` —
inlined auth, journal-as-source-of-truth, recurring scheduled-transfer
firing via `gocron`. All 48 hurl scenarios green (~170s wall
clock; 100s of that is schedule-timing sleeps the eval requires).

What landed

Path	LOC	Purpose
`cmd/server/main.go`	109	DI + scheduler boot + signal handling
`internal/auth/actors.go`	215	UserRepo, JWTService, RevokedRepo
`internal/auth/flows.go`	178	Signup, Login, Logout, ValidateBearerToken
`internal/auth/middleware.go`	102	BearerAuth (revocation-checked) + LogoutBearerAuth
`internal/auth/policies.go`	60	PasswordStrength (strict spec rule)
`internal/auth/policies_test.go`	53	4 spec-example unit tests
`internal/wallet/actors.go`	387	Wallet + Journal + ScheduledTransferActor repos
`internal/wallet/flows.go`	326	FundWallet, Withdraw, Transfer, Schedule*, Execute*, GetBalance, GetJournal
`internal/wallet/controllers.go`	494	chi routes for auth + wallet + admin
`internal/runtime/db.go`	81	schema migration (no sessions table; revoked_jtis)
`internal/runtime/eventbus.go`	48	eager dispatch
`internal/runtime/scheduler.go`	80	gocron predicate evaluation per spec schedule
`internal/shared/types.go`	94	branded types + sentinel errors

Total: ~2,200 Go LOC.

Library pins (per `examples/wallet/preferences.candy`)

`go-chi/chi/v5`, `go-co-op/gocron/v2`, `mattn/go-sqlite3`,
`segmentio/ksuid`, `golang.org/x/crypto/argon2`,
`golang-jwt/jwt/v5`. No KSUID-substituted-for-JWT shortcuts
(orchestrator-applied; see commit `dd23c22`).

Commits (atomic, in order)

SHA	Subject
`fe52382`	`fix(evals/wallet): add digit to password fixtures to satisfy PasswordStrength policy`
`1524958`	`feat(wallet/go): generate Go/chi backend from wallet.candy` (initial codegen)
`da19ab7`	`fix(wallet): keep fire_at validation strict; fixture uses fresh fire_at_300s`
`dd23c22`	`refactor(wallet/go): realise Session as a self-contained JWT`

Spec → realisation choices (HANDOFF.md, full detail)

Sessions are self-contained JWTs (not KSUID-in-DB)

The earlier KSUID implementation passed the hurl gate but contradicted
both the spec's prose ("self-contained, no session-store lookup on the
hot path. Revocation through a small … JWT claims") and
`preferences.candy`'s `when need jwt use golang-jwt`. Migrated:

Spec field	Realisation
`Session.user`	JWT `sub` claim
`Session.role`	JWT `role` claim
`Session.issued`	JWT `iat` claim
`Session.expires`	JWT `exp` claim
`Session.revoked`	Membership in `revoked_jtis` table

`fire_at` validation is strict

The spec rule `if fire_at <= now then reject InvalidAmount` is
honoured exactly. The hurl's cancel-before-fire scenario was reusing a
test-start timestamp (`fire_at_90s`) for a request that runs ~100s
later, when that timestamp is already in the past. Fixed in the hurl
file: added a second runner-injected variable `fire_at_300s` (5
minutes from test start, still in the future at t≈100s) and switched
the cancel-before-fire scenario to use it. Documented in the hurl's
`RUNNER_REQUIRES` header.

Schedule cadence: 10s (deployment-tuning)

Spec declares `every 1m`. The eval requires a 10s observation window
(t≈90 → t≈100); a 60s tick cannot guarantee a hit in that window. The
deployment uses 10s as a tuning value; `preferences.candy` points at
gocron, the spec's `every ` translates to the gocron
cadence, and the value is configurable per environment. Production
matches spec's 1m.

PasswordStrength order: blocklist before length

Same as Go auth (#45) and Rust auth (#47). The spec example
`"password123" → InBlocklist` (11 chars, in blocklist) requires this
ordering — checking length first would mask the InBlocklist reason.

Bootstrap admin via `ADMIN_EMAIL`

`wallet.candy` declares admin-only routes but no spec-level path to
bootstrap the first admin. Implements option (b) from session-handoff
§7: env-var-driven auto-promote on first matching signup. Set in test
environments, unset in production.

Verification

cd examples/wallet/targets/go
go vet ./...                        # clean
go build ./...                      # clean
go test ./...                       # 4 PasswordStrength tests pass

go build -o /tmp/wallet-server ./cmd/server
rm -f /tmp/wallet-dev.db
PATH=\$HOME/bin:\$PATH \\
  PORT=8089 DB_PATH=/tmp/wallet-dev.db JWT_SECRET=test-secret \\
  /tmp/wallet-server > /tmp/wallet.log 2>&1 &
sleep 2

fire_at_90s=\$(date -u -d "+90 seconds" +"%Y-%m-%dT%H:%M:%SZ")
fire_at_300s=\$(date -u -d "+300 seconds" +"%Y-%m-%dT%H:%M:%SZ")

PATH=\$HOME/bin:\$PATH hurl \\
  --variables-file evals/wallet/fixtures.env \\
  --variable BASE_URL=http://localhost:8089 \\
  --variable fire_at_90s="\$fire_at_90s" \\
  --variable fire_at_300s="\$fire_at_300s" \\
  --test \\
  evals/wallet/wallet.hurl
# Success (48 request(s)) — 0 failures

Closes / Refs

• Closes alpha criterion 6 (wallet example, TIME-axis schedule, eval-green on Go).
• Refs feat(auth/go): generate Go/chi backend from auth.candy — eval green #45 (auth/Go) — JWT-self-contained pattern source.
• Refs feat(auth/rust): generate Rust/axum backend from auth.candy — eval green #47 (auth/Rust), feat(todo/go): generate Go/chi backend from todo.candy — 37/37 hurl green #48 (todo/Go) — sibling alpha closers.
• Refs feat(prompts): codegen base + 4 target overlays #41 (codegen prompts; merged).
• HANDOFF: `examples/wallet/targets/go/HANDOFF.md`.