test: add unit tests for marketing and internal contact routes #841

Summary

The marketing contact route and the web internal contact route have zero unit test coverage. The web public contact route has comprehensive tests (300 lines) that could serve as a template.

Untested Routes

• apps/marketing/src/app/api/contact/route.ts — public, unauthenticated, rate-limited — no tests
• apps/web/src/app/api/internal/contact/route.ts — bearer-token-gated — no tests

What to Cover

Marketing route

• Rate limiting (5/hour per IP)
• Field validation (name, email, subject, message)
• Resend email sending (mock)
• Internal API forwarding (mock)
• Error handling

Internal contact route

• Bearer token auth (valid, invalid, missing)
• Field validation
• Database insertion (mock)
• Error handling

Reference

• apps/web/src/app/api/contact/__tests__/route.test.ts — existing comprehensive test suite to use as template

Last reviewed: 2026-04-08 — identified during ReDoS triage (CodeQL #102, #103, #124)