feat(backend): update Square integration, validators, and image validation

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

backend/internal/validators/email_test.go

@@ -155,3 +155,37 @@ func TestValidateEmail_ValidMailsAreSafe(t *testing.T) {
 		}
 	}
 }
+
+func TestParseCursor_Valid(t *testing.T) {
+	tm, id, err := ParseCursor("2026-06-15T10:30:00Z|abc123def456")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if tm.Year() != 2026 || tm.Month() != 6 || tm.Day() != 15 {
+		t.Errorf("unexpected time: %v", tm)
+	}
+	if id != "abc123def456" {
+		t.Errorf("expected id 'abc123def456', got %q", id)
+	}
+}
+
+func TestParseCursor_InvalidFormat(t *testing.T) {
+	_, _, err := ParseCursor("not-a-valid-cursor")
+	if err == nil {
+		t.Fatal("expected error for invalid cursor format, got nil")
+	}
+}
+
+func TestParseCursor_InvalidTimestamp(t *testing.T) {
+	_, _, err := ParseCursor("not-a-time|abc123def456")
+	if err == nil {
+		t.Fatal("expected error for invalid timestamp, got nil")
+	}
+}
+
+func TestParseCursor_EmptyCursor(t *testing.T) {
+	_, _, err := ParseCursor("")
+	if err == nil {
+		t.Fatal("expected error for empty cursor, got nil")
+	}
+}

backend/internal/validators/validators.go

@@ -1,10 +1,12 @@
 package validators
 
 import (
+	"fmt"
 	"github.com/go-playground/validator/v10"
 	"reflect"
 	"regexp"
 	"strings"
+	"time"
 )
 
 var Validate *validator.Validate
@@ -31,3 +33,16 @@ func IsValidID(id string) bool {
 	}
 	return validIDRegex.MatchString(id)
 }
+
+// ParseCursor splits a "createdAt|id" cursor string into its components.
+func ParseCursor(cursor string) (time.Time, string, error) {
+	parts := strings.SplitN(cursor, "|", 2)
+	if len(parts) != 2 {
+		return time.Time{}, "", fmt.Errorf("invalid cursor format")
+	}
+	t, err := time.Parse(time.RFC3339, parts[0])
+	if err != nil {
+		return time.Time{}, "", fmt.Errorf("invalid cursor created_at: %w", err)
+	}
+	return t, parts[1], nil
+}