test: add coverage tests across backend + fix mock for PENDING checkout support

New test files cover previously untested paths across DAV, validators,
S3, Square, mw, bookings, user, and payments packages.

Includes mock fix: HoldCheckouts flag on MockClient allows tests to
pause auto-complete goroutine for testing PENDING checkout states.

Coverage: 50.4% → 65.0% (+14.6pp)

backend/internal/square/square_dev_test.go

@@ -7,6 +7,9 @@ import (
 	"sync"
 	"testing"
 	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestDevClient_CreatePayment_ReturnsCompleted(t *testing.T) {
@@ -308,6 +311,56 @@ func TestDevClient_GetCheckout_NotFound(t *testing.T) {
 	}
 }
 
+func TestDevClient_CreateCardOnFileRaw_Visa(t *testing.T) {
+	client := NewDevClient().(*MockClient)
+	card, err := client.CreateCardOnFileRaw(context.Background(), "user-raw-1", "4111111111111111", 12, 2030, "123")
+	require.NoError(t, err)
+	assert.Equal(t, "VISA", card.Brand)
+	assert.Equal(t, "1111", card.Last4)
+	assert.True(t, card.IsDefault)
+}
+
+func TestDevClient_CreateCardOnFileRaw_Mastercard(t *testing.T) {
+	client := NewDevClient().(*MockClient)
+	ctx := context.Background()
+	// First card to set up non-default check
+	_, err := client.CreateCardOnFileRaw(ctx, "user-raw-2", "4111111111111111", 12, 2030, "123")
+	require.NoError(t, err)
+	// Mastercard is second → not default
+	card, err := client.CreateCardOnFileRaw(ctx, "user-raw-2", "5555555555554444", 12, 2030, "123")
+	require.NoError(t, err)
+	assert.Equal(t, "MASTERCARD", card.Brand)
+	assert.Equal(t, "4444", card.Last4)
+	assert.False(t, card.IsDefault)
+}
+
+func TestDevClient_CreateCardOnFileRaw_Amex(t *testing.T) {
+	client := NewDevClient().(*MockClient)
+	card, err := client.CreateCardOnFileRaw(context.Background(), "user-raw-3", "378282246310005", 12, 2030, "123")
+	require.NoError(t, err)
+	assert.Equal(t, "AMEX", card.Brand)
+	assert.Equal(t, "0005", card.Last4)
+	assert.True(t, card.IsDefault)
+}
+
+func TestDevClient_CreateCardOnFileRaw_Discover(t *testing.T) {
+	client := NewDevClient().(*MockClient)
+	card, err := client.CreateCardOnFileRaw(context.Background(), "user-raw-4", "6011111111111117", 12, 2030, "123")
+	require.NoError(t, err)
+	assert.Equal(t, "DISCOVER", card.Brand)
+	assert.Equal(t, "1117", card.Last4)
+	assert.True(t, card.IsDefault)
+}
+
+func TestDevClient_CreateCardOnFileRaw_UnknownBrand(t *testing.T) {
+	client := NewDevClient().(*MockClient)
+	card, err := client.CreateCardOnFileRaw(context.Background(), "user-raw-5", "9999999999999999", 12, 2030, "123")
+	require.NoError(t, err)
+	assert.Equal(t, "UNKNOWN", card.Brand)
+	assert.Equal(t, "9999", card.Last4)
+	assert.True(t, card.IsDefault)
+}
+
 func TestDevClient_ConcurrentPayments(t *testing.T) {
 	client := NewDevClient().(*MockClient)