test: improve coverage for health.ts and email-change.ts

- Add test for health.ts: client.query() error path with client.release(true)
- Add test for email-change.ts: sendVerificationEmail failure (fire-and-forget)
- Add test for email-change.ts verify: invalid API key (403 response)

Coverage improvements:
- health.ts: 87.09% → 100% lines (covered lines 84-85)
- email-change.ts: 94.33% → 100% lines, 80% → 100% functions (covered lines 112, 176-177)
- Overall: 92.73% → 93.13% lines (+0.40%)
- Total tests: 722 → 725 (+3)

src/__tests__/health.test.ts

@@ -65,4 +65,23 @@ describe("GET /health", () => {
     expect(res.body.version).toBeDefined();
     expect(typeof res.body.version).toBe("string");
   });
+
+  it("returns 503 when client.query() throws and releases client with destroy flag", async () => {
+    const mockRelease = vi.fn();
+    const mockClient = {
+      query: vi.fn().mockRejectedValue(new Error("Query failed")),
+      release: mockRelease,
+    };
+    vi.mocked(pool.connect).mockResolvedValue(mockClient as any);
+
+    const res = await request(app).get("/health");
+    
+    expect(res.status).toBe(503);
+    expect(res.body.status).toBe("degraded");
+    expect(res.body.database.status).toBe("error");
+    expect(res.body.database.message).toContain("Query failed");
+    
+    // Verify client.release(true) was called to destroy the bad connection
+    expect(mockRelease).toHaveBeenCalledWith(true);
+  });
 });