fix: address 4 critical issues in promo code endpoint

[Njko]

Fixes for PR #24

This PR addresses 4 critical issues identified in the code review of PR #24 (promo-code endpoint):

1. Race Condition (app/api/carts/[cartId]/apply-promo/route.ts:102-107)

Problem: Cart subtotal can be modified by another request between read and update
Solution: Added optimistic locking using updated_at timestamp
Impact: Ensures discount is calculated against consistent data

Changes:

• Modified updateCartWithPromo to accept previousUpdatedAt parameter
• Added WHERE clause: AND updated_at = $6 to check optimistic lock
• Returns boolean to indicate success/conflict

2. Uncaught Zod Validation Error (app/api/carts/[cartId]/apply-promo/route.ts:110-119)

Problem: Uses .parse() instead of .safeParse(), masks validation failures as 500 errors
Solution: Changed to .safeParse() with explicit error handling
Impact: Proper error messages for debugging and client feedback

Changes:

• Response validation now uses .safeParse()
• Added explicit validation error handling
• Returns 500 with proper logging on validation failure

3. Silent Failure on Cart Update (lib/db.ts:76-83)

Problem: UPDATE doesn't check rowCount, so cart deletion between validation and update goes undetected
Solution: Check result.rowCount === 1 before returning
Impact: Prevents returning success when cart was deleted

Changes:

• updateCartWithPromo now returns Promise<boolean>
• Returns result.rowCount === 1 to verify exactly 1 row was updated
• Route handler checks return value and returns 409 Conflict on failure

4. Information Disclosure (app/api/carts/[cartId]/apply-promo/route.ts:73, 85, 96)

Problem: Error messages expose cartId and promo code existence
Solution: Use generic error messages that don't reveal internal structure
Impact: Reduces attack surface

Changes:

• Line 73: Removed Cart with ID ${cartId} from error message
• Line 85: Removed Promo code "${promoCode}" does not exist
• Line 96: Removed Promo code "${promoCode}" is expired or inactive
• All replaced with generic: "Promo code is invalid"

Verification

✅ All 25 tests still pass
✅ TypeScript compilation succeeds with no errors
✅ All good parts of original implementation preserved
✅ Changes are minimal and surgical

Files Modified

• app/api/carts/[cartId]/apply-promo/route.ts - Add optimistic locking, use safeParse, generic errors
• lib/db.ts - Check rowCount, return boolean for update status

[Njko]

Closing this PR to address critical security and architecture issues. Will resubmit on fork with comprehensive fixes.