feat(backend): update Square integration, validators, and image validation

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

backend/internal/validators/email_test.go

@@ -155,3 +155,37 @@ func TestValidateEmail_ValidMailsAreSafe(t *testing.T) {
 		}
 	}
 }
+
+func TestParseCursor_Valid(t *testing.T) {
+	tm, id, err := ParseCursor("2026-06-15T10:30:00Z|abc123def456")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if tm.Year() != 2026 || tm.Month() != 6 || tm.Day() != 15 {
+		t.Errorf("unexpected time: %v", tm)
+	}
+	if id != "abc123def456" {
+		t.Errorf("expected id 'abc123def456', got %q", id)
+	}
+}
+
+func TestParseCursor_InvalidFormat(t *testing.T) {
+	_, _, err := ParseCursor("not-a-valid-cursor")
+	if err == nil {
+		t.Fatal("expected error for invalid cursor format, got nil")
+	}
+}
+
+func TestParseCursor_InvalidTimestamp(t *testing.T) {
+	_, _, err := ParseCursor("not-a-time|abc123def456")
+	if err == nil {
+		t.Fatal("expected error for invalid timestamp, got nil")
+	}
+}
+
+func TestParseCursor_EmptyCursor(t *testing.T) {
+	_, _, err := ParseCursor("")
+	if err == nil {
+		t.Fatal("expected error for empty cursor, got nil")
+	}
+}