fix: nil pointer panic when EmailSender is not configured

internal/handlers/auth.go

@@ -114,9 +114,14 @@ func (h *AuthHandler) RequestOTP(w http.ResponseWriter, r *http.Request) {
 
 	// Deliver OTP via email. Log the error but do not fail the request —
 	// during development the code is visible in server logs.
+	if h.EmailSender != nil {
 		if err := h.EmailSender.SendOTP(emailAddr, code); err != nil {
 			log.Printf("ERROR [%s] handlers: RequestOTP SendOTP(%s): %v", time.Now().Format(time.RFC3339), emailAddr, err)
 		}
+	} else {
+		log.Printf("WARN  [%s] handlers: RequestOTP(%s): SMTP not configured — OTP code %s not delivered via email",
+			time.Now().Format(time.RFC3339), emailAddr, code)
+	}
 
 	// Render the OTP verification form as an HTMX fragment.
 	renderOTPForm(w, emailAddr)

internal/handlers/file.go

@@ -139,6 +139,12 @@ func (h *FileHandler) FileEvent(w http.ResponseWriter, r *http.Request) {
 	}
 
 	// 6. Send the report as an email attachment.
+	if h.EmailSender == nil {
+		log.Printf("ERROR [%s] handlers: FileEvent: SMTP not configured, cannot send email",
+			time.Now().Format(time.RFC3339))
+		http.Error(w, "SMTP not configured. Please set SMTP environment variables.", http.StatusInternalServerError)
+		return
+	}
 	subject := "Expense report for event " + event.Name
 	body := "Please find attached the expense report."
 	if err := h.EmailSender.SendReport(to, subject, body, attachment); err != nil {