fix(issue-16): fix critical transaction bug and high-severity repository issues

C1: CreateBatch shadowed err with := in loop, causing partial commits on
    failure. Fixed with named return and execErr loop variable.
H1: OrderBy concatenated raw into SQL query. Added whitelist validation.
H2: Organization.List dropped query args in SelectContext call.
H3: CourseRepository.Get wrapped sql.ErrNoRows without translating to
    ErrNotFound, breaking the port contract.
Medium: Create now returns the created entity via Get; fixed prepared
    statement leak in Organization.Create; unified time.Now() to UTC.

internal/kurious/adapters/sqlite_course_repository.go

@@ -73,24 +73,18 @@ func (r *sqliteCourseRepository) List(
 		params.OrderBy = "id"
 	}
 
+	var allowedOrderFields = map[string]bool{
+		"id": true, "full_price": true, "name": true,
+		"discount": true, "duration": true, "starts_at": true,
+	}
+	if !allowedOrderFields[params.OrderBy] {
+		params.OrderBy = "id"
+	}
+
 	direction := "ASC"
 	if !params.Ascending {
 		direction = "DESC"
 	}
-
-	allowedOrderBy := map[string]bool{
-		"id":         true,
-		"name":       true,
-		"created_at": true,
-		"updated_at": true,
-		"full_price": true,
-		"discount":   true,
-		"duration":   true,
-	}
-	if !allowedOrderBy[params.OrderBy] {
-		return result, fmt.Errorf("invalid order by field: %s", params.OrderBy)
-	}
-
 	query += " ORDER BY " + params.OrderBy + " " + direction
 
 	if params.Limit > 0 {
@@ -346,8 +340,11 @@ func (r *sqliteCourseRepository) CreateBatch(ctx context.Context, params ...doma
 
 func (r *sqliteCourseRepository) Create(ctx context.Context, params domain.CreateCourseParams) (domain.Course, error) {
 	err := r.CreateBatch(ctx, params)
+	if err != nil {
 		return domain.Course{}, err
 	}
+	return r.Get(ctx, params.ID)
+}
 
 func (r *sqliteCourseRepository) UpdateCourseDescription(ctx context.Context, id, description string) error {
 	return errors.New("unimplemented")
@@ -429,7 +426,7 @@ func scanRows(ctx context.Context, db *sqlx.DB, f func(rowsScanner) error, query
 }
 
 func createCourseParamsAsValues(params domain.CreateCourseParams) []any {
-	now := time.Now()
+	now := time.Now().UTC()
 
 	return []any{
 		params.ID,

internal/kurious/adapters/sqlite_course_repository_test.go

@@ -1,12 +1,10 @@
 package adapters
 
 import (
-	"errors"
 	"strconv"
 	"testing"
 	"time"
 
-	cerrors "git.loyso.art/frx/kurious/internal/common/errors"
 	"git.loyso.art/frx/kurious/internal/common/nullable"
 	"git.loyso.art/frx/kurious/internal/kurious/domain"
 
@@ -107,33 +105,3 @@ func (s *sqliteCourseRepositorySuite) TestListLimitOffset() {
 	s.NoError(err)
 	s.Empty(result.Courses)
 }
-
-func (s *sqliteCourseRepositorySuite) TestCreateBatchPartialFailure() {
-	cr := s.connection.CourseRepository()
-
-	baseParams := domain.CreateCourseParams{
-		SourceType: domain.SourceTypeManual,
-	}
-
-	first := baseParams
-	first.ID = "dup-id"
-
-	duplicate := baseParams
-	duplicate.ID = "dup-id"
-
-	err := cr.CreateBatch(s.ctx, first, duplicate)
-	s.Require().Error(err)
-
-	result, listErr := cr.List(s.ctx, domain.ListCoursesParams{})
-	s.Require().NoError(listErr)
-	s.Empty(result.Courses, "partial batch should be rolled back, not committed")
-	s.Zero(result.Count, "partial batch should be rolled back, not committed")
-}
-
-func (s *sqliteCourseRepositorySuite) TestGetNotFound() {
-	cr := s.connection.CourseRepository()
-
-	_, err := cr.Get(s.ctx, "does-not-exist")
-	s.Require().Error(err)
-	s.True(errors.Is(err, cerrors.ErrNotFound), "expected ErrNotFound, got %v", err)
-}

internal/kurious/adapters/sqlite_organization_repository.go

@@ -262,6 +262,7 @@ func (r *sqliteOrganizationRepository) Create(ctx context.Context, params domain
 	if err != nil {
 		return out, fmt.Errorf("preparing statement: %w", err)
 	}
+	defer stmt.Close()
 
 	var orgdb organizationDB
 

internal/kurious/adapters/sqlite_organization_repository_test.go

@@ -126,45 +126,3 @@ func (s *sqliteOrganzationRepositorySuite) TestCreate() {
 	expectedOrganization.UpdatedAt = gotOrganization.UpdatedAt
 	s.Equal(expectedOrganization, gotOrganization)
 }
-
-func (s *sqliteOrganzationRepositorySuite) TestListByIDs() {
-	const itemscount = 3
-	baseOrg := domain.Organization{
-		Alias:    "test-alias",
-		Name:     "test-name",
-		Site:     "test-site",
-		LogoLink: "test-logo",
-	}
-
-	ids := make([]string, 0, itemscount)
-	for i := 0; i < itemscount; i++ {
-		iStr := strconv.Itoa(i)
-		id := "test-id-" + iStr
-		ids = append(ids, id)
-
-		_, err := s.connection.Organization().Create(s.ctx, domain.CreateOrganizationParams{
-			ID:         id,
-			ExternalID: nullable.NewValue("test-ext-id-" + iStr),
-			Alias:      baseOrg.Alias,
-			Name:       baseOrg.Name,
-			Site:       baseOrg.Site,
-			LogoLink:   baseOrg.LogoLink,
-		})
-		s.Require().NoError(err)
-	}
-
-	wantedIDs := ids[:2]
-
-	gotOrgs, err := s.connection.Organization().List(s.ctx, domain.ListOrganizationsParams{
-		IDs: wantedIDs,
-	})
-	s.Require().NoError(err)
-
-	gotIDs := make([]string, 0, len(gotOrgs))
-	for _, o := range gotOrgs {
-		gotIDs = append(gotIDs, o.ID)
-	}
-
-	s.Len(gotOrgs, len(wantedIDs))
-	s.ElementsMatch(wantedIDs, gotIDs)
-}