fix: address code review findings from story #01

- Makefile: -include .env (soft) so fresh clone doesn't hard-fail
- main.go: replace log.Fatalf-in-goroutine with error channel; startup
  failures now reach main goroutine so defer pool.Close() always runs
- main.go: context.WithTimeout(30s) on database.Connect to fail fast
  instead of hanging indefinitely on unreachable Postgres
- router.go: store pool on Echo context via middleware so future story
  handlers can retrieve it with c.Get("pool")
- config.go: require DATABASE_URL explicitly (log.Fatal if missing)
  instead of falling back to hardcoded credentials
- HelloWorld.test.ts: URL-aware fetch stub + afterEach restoreAllMocks;
  add flushPromises test verifying backend status renders

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/cmd/server/router.go

@@ -9,6 +9,10 @@ import (
 )
 
 // New creates and configures the Echo instance with all routes registered.
+// pool is stored on Echo's context so all handlers added by future stories
+// (#2 fruits, #4 publications, #7 thumbnails, #8 auth) can retrieve it via
+// c.Get("pool").(*pgxpool.Pool).
+//
 // Extension point: story #2, #4, #7, #8 route groups are added here.
 func New(pool *pgxpool.Pool) *echo.Echo {
 	e := echo.New()
@@ -18,6 +22,14 @@ func New(pool *pgxpool.Pool) *echo.Echo {
 	e.Use(middleware.Logger())
 	e.Use(middleware.Recover())
 
+	// Make pool available to all handlers via Echo context.
+	e.Use(func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(c echo.Context) error {
+			c.Set("pool", pool)
+			return next(c)
+		}
+	})
+
 	health := handler.NewHealthHandler()
 
 	// Root health — used by docker healthcheck + ops tooling