feat(backend): update Square integration, validators, and image validation

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

backend/internal/square/square_dev.go

@@ -14,6 +14,14 @@ import (
 
 var Client SquareClient
 
+var isTesting = os.Getenv("GO_TESTING") == "1"
+
+func mockSleep(d time.Duration) {
+	if !isTesting {
+		time.Sleep(d)
+	}
+}
+
 type MockClient struct {
 	mu        sync.RWMutex
 	cards     map[string]map[string]*CardOnFile
@@ -72,7 +80,7 @@ func NewDevClient() SquareClient {
 
 func (m *MockClient) CreatePayment(ctx context.Context, req CreatePaymentReq) (*PaymentResult, error) {
 	log.Printf("[SQUARE-MOCK] CreatePayment: amount=%d, reference=%s", req.Amount, req.ReferenceID)
-	time.Sleep(1 * time.Second)
+	mockSleep(1 * time.Second)
 
 	m.mu.Lock()
 	defer m.mu.Unlock()
@@ -110,7 +118,7 @@ func (m *MockClient) CreateCheckout(ctx context.Context, req CreateCheckoutReq)
 	m.mu.Unlock()
 
 	go func() {
-		time.Sleep(3 * time.Second)
+		mockSleep(3 * time.Second)
 
 		m.mu.Lock()
 		defer m.mu.Unlock()
@@ -122,7 +130,7 @@ func (m *MockClient) CreateCheckout(ctx context.Context, req CreateCheckoutReq)
 			tipAmount = 500
 			amount += tipAmount
 		}
-		fees := amount*175/10000 // in-person rate: 1.75%
+		fees := amount * 175 / 10000 // in-person rate: 1.75%
 
 		paymentResult := &PaymentResult{
 			ID:          paymentID,
@@ -171,7 +179,7 @@ func (m *MockClient) GetCheckout(ctx context.Context, checkoutID string) (*Payme
 
 func (m *MockClient) RefundPayment(ctx context.Context, req RefundPaymentReq) (*RefundResult, error) {
 	log.Printf("[SQUARE-MOCK] RefundPayment: payment=%s, amount=%d", req.PaymentID, req.Amount)
-	time.Sleep(1 * time.Second)
+	mockSleep(1 * time.Second)
 
 	m.mu.Lock()
 	defer m.mu.Unlock()

backend/internal/validators/email_test.go

@@ -155,3 +155,37 @@ func TestValidateEmail_ValidMailsAreSafe(t *testing.T) {
 		}
 	}
 }
+
+func TestParseCursor_Valid(t *testing.T) {
+	tm, id, err := ParseCursor("2026-06-15T10:30:00Z|abc123def456")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if tm.Year() != 2026 || tm.Month() != 6 || tm.Day() != 15 {
+		t.Errorf("unexpected time: %v", tm)
+	}
+	if id != "abc123def456" {
+		t.Errorf("expected id 'abc123def456', got %q", id)
+	}
+}
+
+func TestParseCursor_InvalidFormat(t *testing.T) {
+	_, _, err := ParseCursor("not-a-valid-cursor")
+	if err == nil {
+		t.Fatal("expected error for invalid cursor format, got nil")
+	}
+}
+
+func TestParseCursor_InvalidTimestamp(t *testing.T) {
+	_, _, err := ParseCursor("not-a-time|abc123def456")
+	if err == nil {
+		t.Fatal("expected error for invalid timestamp, got nil")
+	}
+}
+
+func TestParseCursor_EmptyCursor(t *testing.T) {
+	_, _, err := ParseCursor("")
+	if err == nil {
+		t.Fatal("expected error for empty cursor, got nil")
+	}
+}

backend/internal/validators/validators.go

@@ -1,10 +1,12 @@
 package validators
 
 import (
+	"fmt"
 	"github.com/go-playground/validator/v10"
 	"reflect"
 	"regexp"
 	"strings"
+	"time"
 )
 
 var Validate *validator.Validate
@@ -31,3 +33,16 @@ func IsValidID(id string) bool {
 	}
 	return validIDRegex.MatchString(id)
 }
+
+// ParseCursor splits a "createdAt|id" cursor string into its components.
+func ParseCursor(cursor string) (time.Time, string, error) {
+	parts := strings.SplitN(cursor, "|", 2)
+	if len(parts) != 2 {
+		return time.Time{}, "", fmt.Errorf("invalid cursor format")
+	}
+	t, err := time.Parse(time.RFC3339, parts[0])
+	if err != nil {
+		return time.Time{}, "", fmt.Errorf("invalid cursor created_at: %w", err)
+	}
+	return t, parts[1], nil
+}