fix(ca): translate sql.ErrNoRows to nil,nil for optional lookups

Repository methods that perform single-row queries now return (nil,nil)
instead of leaking sql.ErrNoRows when a row is missing. This aligns with
service-layer expectations (e.g. GetMediaDetail, ValidateSession,
UpdateProgress, AssignTag, access checks) so normal missing data does
not break app flows.

Files changed:
- internal/repository/media.go, user.go, set.go, set_permission.go,
  tag.go, note.go, playback_progress.go, playback_accumulator.go,
  session.go, share.go
- internal/repository/sqlite_test.go (updated assertions)
- internal/repository/sqlite_no_rows_test.go (new focused repository tests)
- internal/service/no_rows_test.go (new focused service tests)

1 files changed, 132 insertions, 0 deletions

diff --git a/internal/repository/sqlite_no_rows_test.go b/internal/repository/sqlite_no_rows_test.go
new file mode 100644
index 0000000..48ac8a6
--- /dev/null
+++ b/internal/repository/sqlite_no_rows_test.go
@@ -0,0 +1,132 @@
+package repository
+
+import (
+	"context"
+	"testing"
+)
+
+func TestSQLite_NoRows_ReturnsNil(t *testing.T) {
+	ctx := context.Background()
+	s := newTestStore(t)
+	defer s.Close()
+
+	t.Run("GetUserByID", func(t *testing.T) {
+		u, err := s.GetUserByID(ctx, 9999)
+		if err != nil {
+			t.Fatalf("expected no error, got %v", err)
+		}
+		if u != nil {
+			t.Fatalf("expected nil, got %+v", u)
+		}
+	})
+
+	t.Run("GetUserByUsername", func(t *testing.T) {
+		u, err := s.GetUserByUsername(ctx, "nobody")
+		if err != nil {
+			t.Fatalf("expected no error, got %v", err)
+		}
+		if u != nil {
+			t.Fatalf("expected nil, got %+v", u)
+		}
+	})
+
+	t.Run("GetSetByID", func(t *testing.T) {
+		st, err := s.GetSetByID(ctx, 9999)
+		if err != nil {
+			t.Fatalf("expected no error, got %v", err)
+		}
+		if st != nil {
+			t.Fatalf("expected nil, got %+v", st)
+		}
+	})
+
+	t.Run("GetMediaByID", func(t *testing.T) {
+		m, err := s.GetMediaByID(ctx, 9999)
+		if err != nil {
+			t.Fatalf("expected no error, got %v", err)
+		}
+		if m != nil {
+			t.Fatalf("expected nil, got %+v", m)
+		}
+	})
+
+	t.Run("GetTagByID", func(t *testing.T) {
+		tag, err := s.GetTagByID(ctx, 9999)
+		if err != nil {
+			t.Fatalf("expected no error, got %v", err)
+		}
+		if tag != nil {
+			t.Fatalf("expected nil, got %+v", tag)
+		}
+	})
+
+	t.Run("GetTagByName", func(t *testing.T) {
+		tag, err := s.GetTagByName(ctx, "missing")
+		if err != nil {
+			t.Fatalf("expected no error, got %v", err)
+		}
+		if tag != nil {
+			t.Fatalf("expected nil, got %+v", tag)
+		}
+	})
+
+	t.Run("GetPermission", func(t *testing.T) {
+		p, err := s.GetPermission(ctx, 9999, 9999)
+		if err != nil {
+			t.Fatalf("expected no error, got %v", err)
+		}
+		if p != nil {
+			t.Fatalf("expected nil, got %+v", p)
+		}
+	})
+
+	t.Run("GetNote", func(t *testing.T) {
+		n, err := s.GetNote(ctx, 9999, 9999)
+		if err != nil {
+			t.Fatalf("expected no error, got %v", err)
+		}
+		if n != nil {
+			t.Fatalf("expected nil, got %+v", n)
+		}
+	})
+
+	t.Run("GetProgress", func(t *testing.T) {
+		p, err := s.GetProgress(ctx, 9999, 9999)
+		if err != nil {
+			t.Fatalf("expected no error, got %v", err)
+		}
+		if p != nil {
+			t.Fatalf("expected nil, got %+v", p)
+		}
+	})
+
+	t.Run("GetAccumulator", func(t *testing.T) {
+		a, err := s.GetAccumulator(ctx, "nope", 9999)
+		if err != nil {
+			t.Fatalf("expected no error, got %v", err)
+		}
+		if a != nil {
+			t.Fatalf("expected nil, got %+v", a)
+		}
+	})
+
+	t.Run("GetSessionByID", func(t *testing.T) {
+		sess, err := s.GetSessionByID(ctx, "nope")
+		if err != nil {
+			t.Fatalf("expected no error, got %v", err)
+		}
+		if sess != nil {
+			t.Fatalf("expected nil, got %+v", sess)
+		}
+	})
+
+	t.Run("GetShareByToken", func(t *testing.T) {
+		sh, err := s.GetShareByToken(ctx, "nope")
+		if err != nil {
+			t.Fatalf("expected no error, got %v", err)
+		}
+		if sh != nil {
+			t.Fatalf("expected nil, got %+v", sh)
+		}
+	})
+}