test: add focused coverage for upload, queue, and worker paths - #23

What

Adds focused tests for the riskiest previously-untested production paths, spanning the Go API (service, queue, handler, repository) and the Python worker (consumer routing/lifecycle, dedup).

Go

• internal/service/asset_test.go — CreateAsset (presign → public URL → repo insert → response) and MarkAssetUploaded (object verification before DB, transaction commit + job enqueue, idempotent skip when already uploaded, DB failure rollback, enqueue failure propagation) using fakes + go-sqlmock.
• internal/queue/queue_test.go — Enqueue/doXAddWithRetry retry-on-transient-failure, retry exhaustion (typed InternalServerError), deadline short-circuit (no retries on canceled ctx), nil-client typed error, and option defaults. Drives a real *redis.Client through a hook, so the full command path is exercised without a Redis server.
• internal/handler/asset_handler_test.go — upload validation gates (missing/unsupported content type, oversized asset short-circuits before the service, malformed JSON) and mark-uploaded status codes (400 invalid/missing id, 500 service error, 200 success with parsed uuid).
• internal/repository/retry_test.go — shouldRetry transient-vs-permanent classification (serialization/deadlock SQLSTATEs, cancellation never retried) and ToAssetTypeFromMimeType boundaries.

Worker (Python)

• worker/tests/test_consumer_lifecycle.py — success path marks job done + asset ready + acks; already-done and unknown jobs ack without processing.
• worker/tests/test_consumer_message.py — consume() unwraps the API's JSON body field and routes by job_id; asset_id-only routing; malformed message acked; empty poll returns False.
• worker/tests/test_dedup.py — all four check_for_duplicate outcomes (no duplicate, pending canonical, ready canonical with variant cloning + canonical link, canonical with no variants → new asset failed, unknown type raises).
• worker/tests/test_image_pipeline.py — repaired to match the current production signature (content_hash) and content-hash-scoped storage key layout the dedup work introduced.

Small production-adjacent changes

• internal/service/asset.go — the service struct now holds a narrow objectStorage interface (slice of storagex.StorageX, whose unexported method blocks external fakes) and the existing-but-unused queue.Queue interface. No behavior change; enables deterministic service tests.
• .hoplite/settings.json — records the sandbox setup (Go 1.25 toolchain via mise, worker test deps in .venv) so fresh sandboxes can run the suites.

Verification

• go test ./internal/... ./pkg/... — all pass (config, handler, middleware, queue, repository, service, storagex).
• go vet ./internal/... ./pkg/... ./cmd/... — clean.
• .venv/bin/python -m pytest worker/tests/ — 18 passed (was 6 passing + 1 failing due to the signature/format drift).
• Note: tests/performance_suite_test.go still requires PERF_TEST_URL and fails out of the box (t.Fatal when unset); left untouched as out of scope for this change.