fix: improve test infrastructure and add ID validation

- Add TestMain to set test env vars and testdb.TruncateTables for test
  isolation
- Add chi routing context to test helpers for path parameter extraction
- Fix SQL error handling to use errors.Is() instead of ==
- Add validators package with ID validation
- Fix admin test middleware chain (RequireAdmin wrapper)
- Update test user inserts to include phone and date_of_birth fields
- Update service delete test to check soft-delete (is_active=false)
- Update holiday hours test to use new schema (weekday, is_open)
- Add phone number validation tests for UK mobile numbers

backend/handlers/auth/local.go

@@ -9,6 +9,7 @@ import (
 	"crypto/rand"
 	"database/sql"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"log"
 	"net/http"
@@ -384,7 +385,7 @@ func GenerateVerificationCodeHandler(w http.ResponseWriter, r *http.Request) {
 		"SELECT id FROM users WHERE LOWER(email) = $1", email,
 	).Scan(&userID)
 	if err != nil {
-		if err == sql.ErrNoRows {
+		if errors.Is(err, sql.ErrNoRows) {
 			w.Header().Set("Content-Type", "application/json")
 			json.NewEncoder(w).Encode(VerificationResponse{Success: true, Message: "If the email exists, a verification code will be sent"})
 			return
@@ -436,7 +437,23 @@ func VerifyCodeHandler(w http.ResponseWriter, r *http.Request) {
 		code,
 	).Scan(&userID, &purpose, &expiresAt)
 	if err != nil {
-		if err == sql.ErrNoRows {
+		if errors.Is(err, sql.ErrNoRows) {
+			// Check if code exists but was already used or expired
+			var checkUsedAt *time.Time
+			checkErr := db.DB.QueryRow(r.Context(),
+				`SELECT used_at FROM verification_codes WHERE code = $1`, code,
+			).Scan(&checkUsedAt)
+			if checkErr != nil {
+				// Code doesn't exist at all
+				http.Error(w, "invalid or expired code", http.StatusBadRequest)
+				return
+			}
+			// Code exists but was already used
+			if checkUsedAt != nil {
+				http.Error(w, "code already used", http.StatusForbidden)
+				return
+			}
+			// Code exists but expired
 			http.Error(w, "invalid or expired code", http.StatusBadRequest)
 			return
 		}