fix(phase-03): use UUID.hex in raw SQL to fix SQLite UUID format mismatch

str(uuid_obj) produces dashed 36-char format; SQLite stores UUID as 32-char
hex without dashes, so WHERE user_id = :uid never matched. Using .hex fixes
confirm_upload (api/documents.py) and delete_document (services/storage.py).
Removes stale xfail from test_delete_decrements_quota — now passes on SQLite.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/tests/test_quota.py

@@ -192,7 +192,6 @@ async def test_quota_exceeded_response(
     assert detail["limit_bytes"] == 104_857_600, f"Unexpected limit_bytes: {detail}"
 
 
-@pytest.mark.xfail(strict=False, reason="requires PostgreSQL for atomic UUID-typed quota SQL")
 async def test_delete_decrements_quota(
     async_client, db_session, auth_user, mock_minio_presigned, mock_minio_stat, monkeypatch
 ):