fix(api/v2): close export reader when commit fails before streaming

If s.Commit() fails after loading the export file, the StreamResponse
callback that would close the reader never runs, leaking the open
object-storage/file handle. Close it explicitly on that error path.

pkg/routes/api/v2/user_export.go

@@ -146,6 +146,8 @@ func userExportDownload(ctx context.Context, in *userExportPasswordBody) (*huma.
 	// valid after the commit; the StreamResponse callback runs after this returns.
 	if err := s.Commit(); err != nil {
 		_ = s.Rollback()
+		// The stream callback (which closes the reader) won't run on this error path.
+		_ = exportFile.File.Close()
 		return nil, translateDomainError(err)
 	}