test: cover chunk validation edge cases

Add focused regression coverage for validation rules called out in PLAN.md.
Chunk upload tests now prove that an otherwise valid upload rejects an
out-of-range chunk index through the HTTP API. Completion tests now prove that a
manually corrupted chunk file is not assembled into a final file.

Update TESTS.md so the reusable checklist reflects these automated proofs.

Test Plan:
- just check
- just nginx-smoke

Refs: PLAN.md validation checklist

tests/chunk_upload.rs

@@ -68,6 +68,21 @@ async fn rejects_wrong_size_non_final_chunk() -> Result<(), Box<dyn std::error::
     Ok(())
 }
 
+#[tokio::test]
+async fn rejects_out_of_range_chunk_index() -> Result<(), Box<dyn std::error::Error>> {
+    let temp_dir = TempDir::new()?;
+    let app = test_app(temp_dir.path());
+    let upload = create_upload(&app, temp_dir.path(), 4).await?;
+
+    let response = app
+        .oneshot(chunk_request(&upload.upload_id, 1, b"data".to_vec())?)
+        .await?;
+
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+
+    Ok(())
+}
+
 #[tokio::test]
 async fn accepts_duplicate_chunk_when_existing_length_matches()
 -> Result<(), Box<dyn std::error::Error>> {