Canonicalize UUIDs before crossing from database identity to object-storage keys

Canonicalize validated UUIDs before deriving case-sensitive object-storage paths. PostgreSQL UUID equality accepts uppercase and lowercase representations of the same identifier, while object-key prefix matching is case-sensitive. A deletion workflow can therefore remove a database owner but match zero corresponding objects if it builds the storage prefix from the original URL spelling. Use the same canonical representation for writing, retrieval, and deletion, and test mixed-case identifiers end to end. This applies when an object-key namespace derives from normalized database identifiers; do not lowercase arbitrary user-owned object keys.

Evidence/example — 2026-09-15

A synthetic review regression used AAAAAAAA-AAAA-4AAA-8AAA-AAAAAAAAAAAA as deletion input and a lowercase stored prefix. UUID validation preserved the input case, so the unnormalized prefix differed; normalizing after UUID validation made both retrieval and cleanup use the stored namespace. Focused mocked tests verified the corrected path selection. This establishes the application-side mismatch and fix, not production deletion throughput or a deployed cleanup guarantee.