test(03-04): cover framework database, routing and JWT boundaries

- Shared pgx/GORM pool, ICU locale fail, and isolated plugin migrations
- Seven-stage middleware order, missing-guard boot failure, typed 404s
- Adversarial JWT matrix including alg:none, empty secret, and no leak

Co-authored-by: Cursor <cursoragent@cursor.com>

lagoon/order_test.go

@@ -36,4 +36,7 @@ func TestOrderClauseAllowList(t *testing.T) {
 	if _, err := OrderBy(nil, "items.title", "asc", allowed); err == nil {
 		t.Fatal("want nil db error")
 	}
+	if _, err := orderClause("items.title", "asc", nil); err == nil {
+		t.Fatal("empty allow-list must reject")
+	}
 }