test: add coverage tests across backend + fix mock for PENDING checkout support

New test files cover previously untested paths across DAV, validators,
S3, Square, mw, bookings, user, and payments packages.

Includes mock fix: HoldCheckouts flag on MockClient allows tests to
pause auto-complete goroutine for testing PENDING checkout states.

Coverage: 50.4% → 65.0% (+14.6pp)

backend/handlers/user/guest_test.go

@@ -285,3 +285,52 @@ func TestCheckEmail_MissingEmail(t *testing.T) {
 		t.Errorf("expected 'email query parameter required' in body, got %s", rr.Body.String())
 	}
 }
+
+// TestGuestUser_Create_Success verifies that a valid guest user request
+// creates a guest user and returns 201 with the user's details.
+func TestGuestUser_Create_Success(t *testing.T) {
+	// NOT parallel — uses db.Conn state
+	ctx, tx := testutils.SetupTestTx(t)
+
+	reqBody := CreateGuestUserRequest{
+		FirstName: "Jane",
+		LastName:  "Guest",
+		Email:     "jane.guest.success@example.com",
+		Phone:     "07123456789",
+	}
+	body, _ := json.Marshal(reqBody)
+
+	req := httptest.NewRequest(http.MethodPost, "/api/user/guest", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	req = req.WithContext(ctx)
+
+	rr := httptest.NewRecorder()
+	CreateGuestUserHandler(rr, req)
+
+	if rr.Code != http.StatusCreated {
+		t.Errorf("expected status 201, got %d", rr.Code)
+		t.Logf("response body: %s", rr.Body.String())
+	}
+
+	// Verify user was created in DB
+	var count int
+	err := tx.QueryRow(ctx, `SELECT COUNT(*) FROM users WHERE email = $1 AND account_role = 'guest'`, "jane.guest.success@example.com").Scan(&count)
+	if err != nil {
+		t.Fatalf("failed to query users: %v", err)
+	}
+	if count != 1 {
+		t.Errorf("expected 1 guest user (account_role='guest'), got %d", count)
+	}
+
+	// Verify response body contains ID and role
+	var resp CreateGuestUserResponse
+	if err := json.Unmarshal(rr.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("failed to unmarshal response: %v", err)
+	}
+	if resp.ID == "" {
+		t.Error("expected non-empty user ID in response")
+	}
+	if resp.Role != "guest" {
+		t.Errorf("expected role 'guest', got '%s'", resp.Role)
+	}
+}