test: expand backend coverage

[UberMetroid]

Summary

• add serialized, hermetic AppConfig environment parsing coverage
• cover upload metadata serialization/filesystem round trips, upload ID path safety, filename and extension handling, size/storage/batch/folder validation
• serialize security lockout environment/global state and add fmt/clippy CI checks
• reject upload metadata IDs that are absolute, nested, or separator-containing

Validation

• cargo test --workspace
• cargo check --workspace
• cargo fmt --all -- --check
• cargo clippy --workspace -- -D warnings
• git diff --check