test: add coverage tests across backend + fix mock for PENDING checkout support

New test files cover previously untested paths across DAV, validators,
S3, Square, mw, bookings, user, and payments packages.

Includes mock fix: HoldCheckouts flag on MockClient allows tests to
pause auto-complete goroutine for testing PENDING checkout states.

Coverage: 50.4% → 65.0% (+14.6pp)

backend/handlers/admin/patch_tests_test.go

@@ -3,11 +3,16 @@
 package admin
 
 import (
+	"bytes"
+	"context"
 	"net/http"
+	"net/http/httptest"
 	"testing"
 
 	"crussell/testutils"
 	"crussell/testutils/fixtures"
+
+	"github.com/go-chi/chi/v5"
 )
 
 func TestPatchTests_CRUD(t *testing.T) {
@@ -63,3 +68,266 @@ func TestPatchTests_CRUD(t *testing.T) {
 func strPtr(s string) *string {
 	return &s
 }
+
+// =============================================================================
+// Create Patch Test - Validation Tests
+// =============================================================================
+
+func TestCreatePatchTest_ValidationErrors(t *testing.T) {
+	ctx, tx := testutils.SetupTestTx(t)
+
+	handler := http.HandlerFunc(CreatePatchTest)
+
+	t.Run("empty_name", func(t *testing.T) {
+		req := CreatePatchTestRequest{
+			Name:                "",
+			NoticeDurationHours: 24,
+			ExpiryMonths:        6,
+		}
+		w := makeAdminRequest(handler, "POST", "/api/admin/patch-tests", req, ctx)
+		if w.Code != http.StatusBadRequest {
+			t.Errorf("expected 400 for empty name, got %d. body: %s", w.Code, w.Body.String())
+		}
+	})
+
+	_, err := tx.Exec(ctx, `SELECT 1`)
+	if err != nil {
+		t.Fatalf("tx check failed: %v", err)
+	}
+}
+
+// =============================================================================
+// Update Patch Test - Error Tests
+// =============================================================================
+
+func TestUpdatePatchTest_NotFound(t *testing.T) {
+	ctx, tx := testutils.SetupTestTx(t)
+	serviceID, err := fixtures.CreateTestService(tx)
+	if err != nil {
+		t.Fatalf("failed to create service: %v", err)
+	}
+
+	createReq := CreatePatchTestRequest{
+		Name:                "Test",
+		NoticeDurationHours: 24,
+		ExpiryMonths:        6,
+		ServiceIDs:          []string{serviceID},
+	}
+	w := makeAdminRequest(http.HandlerFunc(CreatePatchTest), "POST", "/api/admin/patch-tests", createReq, ctx)
+	if w.Code != http.StatusCreated {
+		t.Fatalf("failed to create patch test: %d", w.Code)
+	}
+
+	newName := "Updated"
+	updateReq := UpdatePatchTestRequest{Name: &newName}
+	w = makeAdminRequest(http.HandlerFunc(UpdatePatchTest), "PUT", "/api/admin/patch-tests/nonexistent-id", updateReq, ctx)
+	if w.Code != http.StatusNotFound {
+		t.Errorf("expected 404 for nonexistent patch test, got %d. body: %s", w.Code, w.Body.String())
+	}
+}
+
+// =============================================================================
+// Delete Patch Test - Error Tests
+// =============================================================================
+
+func TestDeletePatchTest_NotFound(t *testing.T) {
+	ctx, tx := testutils.SetupTestTx(t)
+	serviceID, err := fixtures.CreateTestService(tx)
+	if err != nil {
+		t.Fatalf("failed to create service: %v", err)
+	}
+
+	createReq := CreatePatchTestRequest{
+		Name:                "Test",
+		NoticeDurationHours: 24,
+		ExpiryMonths:        6,
+		ServiceIDs:          []string{serviceID},
+	}
+	w := makeAdminRequest(http.HandlerFunc(CreatePatchTest), "POST", "/api/admin/patch-tests", createReq, ctx)
+	if w.Code != http.StatusCreated {
+		t.Fatalf("failed to create patch test: %d", w.Code)
+	}
+
+	w = makeAdminRequest(http.HandlerFunc(DeletePatchTest), "DELETE", "/api/admin/patch-tests/nonexistent-id", nil, ctx)
+	if w.Code != http.StatusNotFound {
+		t.Errorf("expected 404 for nonexistent patch test, got %d. body: %s", w.Code, w.Body.String())
+	}
+}
+
+// =============================================================================
+// Update Patch Test - Individual Field Update Tests
+// =============================================================================
+
+func TestUpdatePatchTest_UpdateDescription(t *testing.T) {
+	ctx, tx := testutils.SetupTestTx(t)
+	serviceID, err := fixtures.CreateTestService(tx)
+	if err != nil {
+		t.Fatalf("failed to create service: %v", err)
+	}
+
+	createReq := CreatePatchTestRequest{
+		Name:                "Test",
+		NoticeDurationHours: 24,
+		ExpiryMonths:        6,
+		ServiceIDs:          []string{serviceID},
+	}
+	w := makeAdminRequest(http.HandlerFunc(CreatePatchTest), "POST", "/api/admin/patch-tests", createReq, ctx)
+	if w.Code != http.StatusCreated {
+		t.Fatalf("failed to create patch test: %d", w.Code)
+	}
+
+	var created struct {
+		ID string `json:"id"`
+	}
+	parseResponseBody(w, &created)
+
+	updateReq := UpdatePatchTestRequest{Description: strPtr("Updated Description")}
+	w = makeAdminRequest(http.HandlerFunc(UpdatePatchTest), "PUT", "/api/admin/patch-tests/"+created.ID, updateReq, ctx)
+	if w.Code != http.StatusNoContent {
+		t.Fatalf("expected 204, got %d, body: %s", w.Code, w.Body.String())
+	}
+}
+
+func TestUpdatePatchTest_UpdateNoticeDuration(t *testing.T) {
+	ctx, tx := testutils.SetupTestTx(t)
+	serviceID, err := fixtures.CreateTestService(tx)
+	if err != nil {
+		t.Fatalf("failed to create service: %v", err)
+	}
+
+	createReq := CreatePatchTestRequest{
+		Name:                "Test",
+		NoticeDurationHours: 24,
+		ExpiryMonths:        6,
+		ServiceIDs:          []string{serviceID},
+	}
+	w := makeAdminRequest(http.HandlerFunc(CreatePatchTest), "POST", "/api/admin/patch-tests", createReq, ctx)
+	if w.Code != http.StatusCreated {
+		t.Fatalf("failed to create patch test: %d", w.Code)
+	}
+
+	var created struct {
+		ID string `json:"id"`
+	}
+	parseResponseBody(w, &created)
+
+	noticeDuration := 48
+	updateReq := UpdatePatchTestRequest{NoticeDurationHours: &noticeDuration}
+	w = makeAdminRequest(http.HandlerFunc(UpdatePatchTest), "PUT", "/api/admin/patch-tests/"+created.ID, updateReq, ctx)
+	if w.Code != http.StatusNoContent {
+		t.Fatalf("expected 204, got %d, body: %s", w.Code, w.Body.String())
+	}
+}
+
+func TestUpdatePatchTest_UpdateExpiryMonths(t *testing.T) {
+	ctx, tx := testutils.SetupTestTx(t)
+	serviceID, err := fixtures.CreateTestService(tx)
+	if err != nil {
+		t.Fatalf("failed to create service: %v", err)
+	}
+
+	createReq := CreatePatchTestRequest{
+		Name:                "Test",
+		NoticeDurationHours: 24,
+		ExpiryMonths:        6,
+		ServiceIDs:          []string{serviceID},
+	}
+	w := makeAdminRequest(http.HandlerFunc(CreatePatchTest), "POST", "/api/admin/patch-tests", createReq, ctx)
+	if w.Code != http.StatusCreated {
+		t.Fatalf("failed to create patch test: %d", w.Code)
+	}
+
+	var created struct {
+		ID string `json:"id"`
+	}
+	parseResponseBody(w, &created)
+
+	expiryMonths := 12
+	updateReq := UpdatePatchTestRequest{ExpiryMonths: &expiryMonths}
+	w = makeAdminRequest(http.HandlerFunc(UpdatePatchTest), "PUT", "/api/admin/patch-tests/"+created.ID, updateReq, ctx)
+	if w.Code != http.StatusNoContent {
+		t.Fatalf("expected 204, got %d, body: %s", w.Code, w.Body.String())
+	}
+}
+
+func TestUpdatePatchTest_UpdateServiceIDs(t *testing.T) {
+	ctx, tx := testutils.SetupTestTx(t)
+	serviceID, err := fixtures.CreateTestService(tx)
+	if err != nil {
+		t.Fatalf("failed to create service: %v", err)
+	}
+
+	createReq := CreatePatchTestRequest{
+		Name:                "Test",
+		NoticeDurationHours: 24,
+		ExpiryMonths:        6,
+		ServiceIDs:          []string{serviceID},
+	}
+	w := makeAdminRequest(http.HandlerFunc(CreatePatchTest), "POST", "/api/admin/patch-tests", createReq, ctx)
+	if w.Code != http.StatusCreated {
+		t.Fatalf("failed to create patch test: %d", w.Code)
+	}
+
+	var created struct {
+		ID string `json:"id"`
+	}
+	parseResponseBody(w, &created)
+
+	updateReq := UpdatePatchTestRequest{ServiceIDs: []string{serviceID}}
+	w = makeAdminRequest(http.HandlerFunc(UpdatePatchTest), "PUT", "/api/admin/patch-tests/"+created.ID, updateReq, ctx)
+	if w.Code != http.StatusNoContent {
+		t.Fatalf("expected 204, got %d, body: %s", w.Code, w.Body.String())
+	}
+}
+
+func TestUpdatePatchTest_InvalidJSON(t *testing.T) {
+	ctx, _ := testutils.SetupTestTx(t)
+
+	req := httptest.NewRequest("PUT", "/api/admin/patch-tests/abcdef123456", bytes.NewReader([]byte(`{invalid}`)))
+	req.Header.Set("Content-Type", "application/json")
+	rctx := chi.NewRouteContext()
+	rctx.URLParams.Add("id", "abcdef123456")
+	ctx = context.WithValue(ctx, chi.RouteCtxKey, rctx)
+	req = req.WithContext(ctx)
+
+	w := httptest.NewRecorder()
+	http.HandlerFunc(UpdatePatchTest).ServeHTTP(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("expected 400 for invalid JSON, got %d. body: %s", w.Code, w.Body.String())
+	}
+}
+
+func TestUpdatePatchTest_ValidationError(t *testing.T) {
+	ctx, tx := testutils.SetupTestTx(t)
+	serviceID, err := fixtures.CreateTestService(tx)
+	if err != nil {
+		t.Fatalf("failed to create service: %v", err)
+	}
+
+	createReq := CreatePatchTestRequest{
+		Name:                "Test",
+		NoticeDurationHours: 24,
+		ExpiryMonths:        6,
+		ServiceIDs:          []string{serviceID},
+	}
+	w := makeAdminRequest(http.HandlerFunc(CreatePatchTest), "POST", "/api/admin/patch-tests", createReq, ctx)
+	if w.Code != http.StatusCreated {
+		t.Fatalf("failed to create patch test: %d", w.Code)
+	}
+
+	var created struct {
+		ID string `json:"id"`
+	}
+	parseResponseBody(w, &created)
+
+	var longName string
+	for i := 0; i < 201; i++ {
+		longName += "a"
+	}
+	updateReq := UpdatePatchTestRequest{Name: &longName}
+	w = makeAdminRequest(http.HandlerFunc(UpdatePatchTest), "PUT", "/api/admin/patch-tests/"+created.ID, updateReq, ctx)
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("expected 400 for validation error, got %d. body: %s", w.Code, w.Body.String())
+	}
+}