fix: validate document uploads and allow clearing expiry dates

tests/http-state.test.mjs

@@ -42,6 +42,9 @@ test('HTTP documents and API keys expose empty successful state, not endless loa
 
 test('HTTP file upload, owned download, metadata update and deletion operate on actual bytes',async()=>{
  const bytes=Buffer.from('QA belge — Türkçe içerik, yalnız izole test.');
+ for (const invalid of ['!!!!','a','a===','AB==',[],{}]) {
+  assert.equal((await request('/api/me/documents','POST',{ad:'broken.txt',icerikBase64:invalid})).status,400);
+ }
  const uploaded=await request('/api/me/documents','POST',{ad:'qa.txt',mime:'text/plain',icerikBase64:bytes.toString('base64'),kategori:'Firma',sonKullanma:'2026-12-31'});
  assert.equal(uploaded.status,200);
  const id=uploaded.data.id;
@@ -52,6 +55,17 @@ test('HTTP file upload, owned download, metadata update and deletion operate on
  assert.equal((await request('/api/me/documents/download?id='+id,'GET',null,other)).status,404);
  assert.equal((await request('/api/me/documents/meta','PATCH',{id,sonKullanma:'2027-01-01'})).status,200);
  const changed=await request('/api/me/documents');assert.equal(changed.data.belgeler.find(f=>f.id===id).son_kullanma,'2027-01-01');
+ for (const invalid of ['2027-02-29','2026-02-31','2026-12-31suffix',42]) {
+  assert.equal((await request('/api/me/documents/meta','PATCH',{id,sonKullanma:invalid})).status,400);
+  assert.equal((await request('/api/me/documents','POST',{ad:'invalid.txt',icerikBase64:bytes.toString('base64'),sonKullanma:invalid})).status,400);
+ }
+ const categoryOnly=await request('/api/me/documents/meta','PATCH',{id,kategori:'Yeterlik'});
+ assert.equal(categoryOnly.data.belgeler.find(f=>f.id===id).son_kullanma,'2027-01-01');
+ assert.equal((await request('/api/me/documents/meta','PATCH',{id,sonKullanma:null},other)).status,404);
+ const cleared=await request('/api/me/documents/meta','PATCH',{id,sonKullanma:null});
+ assert.equal(cleared.data.belgeler.find(f=>f.id===id).son_kullanma,null);
+ assert.equal(cleared.data.belgeler.find(f=>f.id===id).kategori,'Yeterlik');
+ assert.equal((await request('/api/me/documents')).data.belgeler.length,1);
  assert.equal((await request('/api/me/documents?id='+id,'DELETE')).status,200);
  assert.equal((await request('/api/me/documents/download?id='+id)).status,404);
 });