refactor: remove auto deposit penalty on no-shows, add comprehensive tests

- Remove automatic deposits_required=3 on no-shows, give admin flexibility
- Add tests for no-show deposit logic (forgiven, over 24h, under 24h)
- Add tests for reservation cleanup TTL (admin walk-in/call-in 15min)
- Add tests for EXIF GPS data stripping in portfolio images
- Add tests for contact info endpoint
- Add tests for guest account anonymization

backend/handlers/user/guest_test.go

@@ -0,0 +1,134 @@
+//go:build test
+// +build test
+
+package user
+
+// Package user contains tests for guest user creation endpoints.
+//
+// Test Coverage:
+//   - CreateGuestUserHandler: POST /api/user/guest - Create a new guest user
+//
+// Edge case tests for validation:
+//   - Invalid phone number format
+//   - Empty first name
+//   - Name exceeds 50 character limit
+//   - Invalid email format
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"crussell/testutils/jwt"
+)
+
+// TestGuestUser_Create_InvalidPhone verifies that an invalid phone number returns 400 Bad Request.
+func TestGuestUser_Create_InvalidPhone(t *testing.T) {
+	cleanup, _ := setupTest(t)
+	defer cleanup()
+
+	jwt.Init()
+
+	reqBody := CreateGuestUserRequest{
+		FirstName: "Test",
+		LastName:  "User",
+		Email:     "test@test.com",
+		Phone:     "not-a-phone",
+	}
+	body, _ := json.Marshal(reqBody)
+
+	req := httptest.NewRequest(http.MethodPost, "/api/user/guest", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+
+	rr := httptest.NewRecorder()
+	CreateGuestUserHandler(rr, req)
+
+	if rr.Code != http.StatusBadRequest {
+		t.Errorf("expected status 400, got %d", rr.Code)
+		t.Logf("response body: %s", rr.Body.String())
+	}
+}
+
+// TestGuestUser_Create_EmptyFirstName verifies that an empty first name returns 400 Bad Request.
+func TestGuestUser_Create_EmptyFirstName(t *testing.T) {
+	cleanup, _ := setupTest(t)
+	defer cleanup()
+
+	jwt.Init()
+
+	reqBody := CreateGuestUserRequest{
+		FirstName: "",
+		LastName:  "User",
+		Email:     "test@test.com",
+		Phone:     "07123456789",
+	}
+	body, _ := json.Marshal(reqBody)
+
+	req := httptest.NewRequest(http.MethodPost, "/api/user/guest", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+
+	rr := httptest.NewRecorder()
+	CreateGuestUserHandler(rr, req)
+
+	if rr.Code != http.StatusBadRequest {
+		t.Errorf("expected status 400, got %d", rr.Code)
+		t.Logf("response body: %s", rr.Body.String())
+	}
+}
+
+// TestGuestUser_Create_NameTooLong verifies that a first name exceeding 50 characters returns 400 Bad Request.
+func TestGuestUser_Create_NameTooLong(t *testing.T) {
+	cleanup, _ := setupTest(t)
+	defer cleanup()
+
+	jwt.Init()
+
+	reqBody := CreateGuestUserRequest{
+		FirstName: strings.Repeat("a", 51),
+		LastName:  "User",
+		Email:     "test@test.com",
+		Phone:     "07123456789",
+	}
+	body, _ := json.Marshal(reqBody)
+
+	req := httptest.NewRequest(http.MethodPost, "/api/user/guest", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+
+	rr := httptest.NewRecorder()
+	CreateGuestUserHandler(rr, req)
+
+	if rr.Code != http.StatusBadRequest {
+		t.Errorf("expected status 400, got %d", rr.Code)
+		t.Logf("response body: %s", rr.Body.String())
+	}
+}
+
+// TestGuestUser_Create_InvalidEmail verifies that an invalid email format returns 400 Bad Request.
+func TestGuestUser_Create_InvalidEmail(t *testing.T) {
+	cleanup, _ := setupTest(t)
+	defer cleanup()
+
+	jwt.Init()
+
+	reqBody := CreateGuestUserRequest{
+		FirstName: "Test",
+		LastName:  "User",
+		Email:     "not-an-email",
+		Phone:     "07123456789",
+	}
+	body, _ := json.Marshal(reqBody)
+
+	req := httptest.NewRequest(http.MethodPost, "/api/user/guest", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+
+	rr := httptest.NewRecorder()
+	CreateGuestUserHandler(rr, req)
+
+	if rr.Code != http.StatusBadRequest {
+		t.Errorf("expected status 400, got %d", rr.Code)
+		t.Logf("response body: %s", rr.Body.String())
+	}
+}