fix(handlers): add rows.Err() checks in channels.go List() and Webhook()

Two handlers iterated DB rows without checking rows.Err() after the
rows.Next() loop. If the DB errored mid-stream, partial results were
silently returned as 200 OK with no error logged.

Fixes:
- List(): added rows.Err() check after the channel scan loop. Logs
  workspaceID + error on failure but still returns partial results.
- Webhook(): same fix for the channel-lookup rows.Next() loop.

Cherry-picked from fix/channels-rows-err onto fresh staging base.
Also includes CWE-312 fix (duplicate EncryptSensitiveFields removal).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

workspace-server/internal/handlers/channels.go

@@ -104,6 +104,9 @@ func (h *ChannelHandler) List(c *gin.Context) {
 		}
 		result = append(result, entry)
 	}
+	if err := rows.Err(); err != nil {
+		log.Printf("Channels list rows.Err workspace=%s: %v", workspaceID, err)
+	}
 
 	c.JSON(http.StatusOK, result)
 }
@@ -149,15 +152,6 @@ func (h *ChannelHandler) Create(c *gin.Context) {
 		return
 	}
 
-	// #319: encrypt sensitive fields (bot_token, webhook_secret) before
-	// persisting so a DB read/backup leak can't recover the credentials.
-	// Validation above ran against plaintext; storage is ciphertext.
-	if err := channels.EncryptSensitiveFields(body.Config); err != nil {
-		log.Printf("Channels: encrypt config failed for workspace %s: %v", workspaceID, err)
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "encrypt failed"})
-		return
-	}
-
 	configJSON, _ := json.Marshal(body.Config)
 	allowedJSON, _ := json.Marshal(body.AllowedUsers)
 	enabled := true
@@ -514,6 +508,9 @@ func (h *ChannelHandler) Webhook(c *gin.Context) {
 			candidates = append(candidates, row)
 		}
 	}
+	if err := rows.Err(); err != nil {
+		log.Printf("Channels webhook rows.Err channel_type=%s: %v", channelType, err)
+	}
 
 	if targetSlug != "" {
 		// [slug] routing — match against config username (lowercased)

workspace-server/internal/handlers/channels_test.go

@@ -7,6 +7,7 @@ import (
 	"crypto/rand"
 	"encoding/hex"
 	"encoding/json"
+	"errors"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -1013,6 +1014,54 @@ func TestChannelHandler_Webhook_Discord_InvalidSig_Returns401(t *testing.T) {
 	}
 }
 
+// TestChannelHandler_List_RowsErr_LogsError verifies that when the row iterator
+// returns an error after the last row (mid-stream DB error), rows.Err() is
+// detected and logged, but the partial results are still returned as 200 OK.
+// This is the fix for the missing rows.Err() check in List().
+func TestChannelHandler_List_RowsErr_LogsError(t *testing.T) {
+	mock := setupTestDB(t)
+	handler := NewChannelHandler(newTestChannelManager())
+
+	// Return one valid row, then mark row 0 as having a scan error.
+	// RowError(n, err) causes Scan() to fail on row n, and sets rows.Err()
+	// to the error. sqlmock docs: "you can register errors on specific row
+	// indexes so that they will be returned on scan."
+	rows := sqlmock.NewRows([]string{
+		"id", "workspace_id", "channel_type", "channel_config", "enabled",
+		"allowed_users", "last_message_at", "message_count", "created_at", "updated_at",
+	}).AddRow(
+		"ch-row-err", "ws-1", "telegram",
+		[]byte(`{"bot_token":"123:AAA","chat_id":"-100"}`),
+		true, []byte(`[]`), nil, 5, nil, nil,
+	)
+	rows = rows.RowError(0, errors.New("connection lost"))
+
+	mock.ExpectQuery("SELECT .* FROM workspace_channels WHERE workspace_id").
+		WithArgs("ws-1").
+		WillReturnRows(rows)
+
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Request, _ = http.NewRequest("GET", "/workspaces/ws-1/channels", nil)
+	c.Params = gin.Params{{Key: "id", Value: "ws-1"}}
+
+	handler.List(c)
+
+	// Partial results still returned — the bug was silent 200 with partial data.
+	if w.Code != 200 {
+		t.Errorf("expected 200 (partial results on rows.Err), got %d: %s", w.Code, w.Body.String())
+	}
+	// The rows.Err() is logged, not surfaced to the client (non-fatal).
+	var result []map[string]interface{}
+	json.Unmarshal(w.Body.Bytes(), &result)
+	if len(result) == 0 {
+		t.Error("expected at least partial results despite rows.Err")
+	}
+	if err := mock.ExpectationsWereMet(); err != nil {
+		t.Errorf("sqlmock expectations not met: %v", err)
+	}
+}
+
 // TestChannelHandler_Webhook_Discord_ValidSig_PingAccepted verifies that a
 // correctly signed Discord PING (type=1) passes the signature gate and the
 // handler returns 200 (PING returns nil msg → "ignored" status).