Fix app version parsing

[GianniCarlo]

No description provided.

[github-actions]

✅ Claude PR Review — PASS

This PR fixes an unhandled 500 on POST /v1/user/second_onboarding where semver.gte(app_version, minVersion) threw Invalid version when older clients omitted or malformed app_version. It introduces a meetsMinVersion helper that guards with semver.valid() before comparing, and applies it at both call sites in secondOnboarding/handleDefaultOnboarding. A regression test covering the missing-app_version case was added. The change is defensive-only and does not affect auth-middleware coverage, authorization scoping, IAP/passkey validation, or data access; no security or layering concerns in the changed lines.

Findings: no findings

_{Model claude-opus-4-8 · run log · 0 new · 0 carried over · 0 resolved · advisory (a human should still review). Duplicate findings are de-duplicated and stale ones auto-resolved across pushes.}