fix: restore S3 error stubs, add CI timeouts, gofmt handlers.go, fix comment

- s3.go: restore error returns on prod Upload/Download/Delete stubs
  (silent nil was dangerous — callers would think writes succeeded)
- CI: add -timeout 300s to tests, -timeout 480s to race, GO_TESTING to race env
- handlers.go: gofmt indentation fix for GetCheckoutStatus struct literal
- validators.go: fix comment to include A-F (matched the regex)

backend/internal/s3/s3.go

@@ -50,19 +50,15 @@ func Connect() error {
 }
 
 func (s *S3Client) Upload(ctx context.Context, bucket, key string, body io.Reader, contentType string) error {
-	// TODO: Wire in AWS SDK v2 for production S3 uploads.
-	// Currently only available under //go:build dev via RUSTFS.
-	return nil
+	return fmt.Errorf("not implemented: production S3 upload requires AWS SDK v2 (use RUSTFS in dev)")
 }
 
 func (s *S3Client) Download(ctx context.Context, bucket, key string, w io.Writer) error {
-	// TODO: Wire in AWS SDK v2 for production S3 downloads.
-	return nil
+	return fmt.Errorf("not implemented: production S3 download requires AWS SDK v2 (use RUSTFS in dev)")
 }
 
 func (s *S3Client) Delete(ctx context.Context, bucket, key string) error {
-	// TODO: Wire in AWS SDK v2 for production S3 deletes.
-	return nil
+	return fmt.Errorf("not implemented: production S3 delete requires AWS SDK v2 (use RUSTFS in dev)")
 }
 
 func (s *S3Client) GetURL(ctx context.Context, bucket, key string) (string, error) {

backend/internal/validators/validators.go

@@ -27,7 +27,7 @@ func init() {
 var validIDRegex = regexp.MustCompile(`^[0-9a-fA-F]{12}$`)
 
 // IsValidID checks if an ID is valid based on the database constraint (CHAR(12) hex string)
-// Valid IDs are exactly 12 hexadecimal characters (0-9, a-f)
+// Valid IDs are exactly 12 hexadecimal characters (0-9, a-f, A-F)
 func IsValidID(id string) bool {
 	if id == "" {
 		return false