Function validate_expires_secs 

fn validate_expires_secs(expires_secs: u64) -> Result<(), AppError>

Pure validation helper extracted so unit tests can call it without a real client. The command and presign_get_object both call this inline for consistency.