Handle edge case when last event is not null

[GianniCarlo]

No description provided.

[github-actions]

✅ Claude PR Review — PASS

PR #35 is a targeted bugfix + cleanup. The core fix adds a lastEvent != null guard in UserController.handleDefaultOnboarding (secondOnboarding flow) to stop a production 500 when a SECOND_ONBOARDING_SKIP exists but its START event was never recorded; return types in UserDB.getLastUserEvent/UserServices.getLastUserEvent were made nullable to match, and a regression test was added. The error middleware's swapped req/res parameter types were corrected and 5xx errors now log method/url/stack at error level (no sensitive fields exposed). The /v1/storage router and StorageController were removed; no remaining code references them (only stale entries in CLAUDE.md docs). No authorization-scoping, auth-middleware, IAP, passkey, secret, or SQL-injection concerns arise from these changes. Note: CLAUDE.md still documents the now-removed Storage routes and should be updated, but that file isn't touched by this PR.

Findings: no findings

_{Model claude-opus-4-8 · run log · 0 new · 0 carried over · 0 resolved · advisory (a human should still review). Duplicate findings are de-duplicated and stale ones auto-resolved across pushes.}