test: cover chunk validation edge cases

Add focused regression coverage for validation rules called out in PLAN.md.
Chunk upload tests now prove that an otherwise valid upload rejects an
out-of-range chunk index through the HTTP API. Completion tests now prove that a
manually corrupted chunk file is not assembled into a final file.

Update TESTS.md so the reusable checklist reflects these automated proofs.

Test Plan:
- just check
- just nginx-smoke

Refs: PLAN.md validation checklist

TESTS.md

@@ -14,10 +14,12 @@ Keep this file as the reusable verification checklist while implementing
     - `POST /api/uploads` rejects an empty file name.
     - `PUT /api/uploads/:id/chunks/:index` stores validated chunk files.
     - `PUT /api/uploads/:id/chunks/:index` rejects wrong-size chunks.
+    - `PUT /api/uploads/:id/chunks/:index` rejects out-of-range indexes.
     - `PUT /api/uploads/:id/chunks/:index` accepts duplicate chunks.
     - `GET /api/uploads/:id` reports completed chunks from disk.
     - `POST /api/uploads/:id/complete` assembles verified chunks.
     - `POST /api/uploads/:id/complete` rejects incomplete uploads.
+    - `POST /api/uploads/:id/complete` rejects corrupt chunk files.
     - `static/app.js` passes `node --check`.
 - `just nginx-smoke`
   - Runs upl behind nginx in Docker.