### Context
- File: `src/services/UserService.ts:45`
- Function: `getProfile(userId)`
- Current: Returns 500 on missing user
- Stack trace shows null dereference at line 52

### Requirement
- Return 404 with `{ error: "user_not_found" }` for missing users
- Keep existing behavior for valid users
- Add null check before accessing user.id

### Current Code
\`\`\`typescript
// src/services/UserService.ts:45-55
async getProfile(userId: string) {
  const user = await this.repo.findById(userId);
  return {
    id: user.id,  // <-- crashes here when user is null
    name: user.name
  };
}
\`\`\`

### Acceptance Criteria
- [ ] `getProfile()` returns 404 for non-existent users
- [ ] Response includes `{ error: "user_not_found" }`
- [ ] Existing tests pass
- [ ] New test covers null user case
- [ ] No console errors in browser

Error: TypeError: Cannot read property 'id' of null
    at UserService.getProfile (src/services/UserService.ts:52:15)
    at async ProfileController.show (src/controllers/profile.ts:18:22)

Related: task-12 (same service), task-8 (similar null handling)
See also: PR #234 where we fixed the same pattern in OrderService

Per RFC 7519 section 4.1 - JWT claims must include 'exp'
Following pattern from: https://docs.example.com/auth#tokens

Files to modify:
- src/services/UserService.ts (main fix)
- src/services/__tests__/UserService.test.ts (add test)
- src/types/errors.ts (add UserNotFoundError if needed)

## task-42 Fix null user crash in getProfile

[p2] [backend] [bug]

### Context
- File: `src/services/UserService.ts:45-55`
- Current: `getProfile()` crashes when user not found
- Error: `TypeError: Cannot read property 'id' of null`
- Reproduces: Call `/api/users/nonexistent-id`

### Current Code
\`\`\`typescript
async getProfile(userId: string) {
  const user = await this.repo.findById(userId);
  return {
    id: user.id,  // crashes when user is null
    name: user.name
  };
}
\`\`\`

### Requirement
Return 404 response instead of crashing. Use existing NotFoundError pattern from OrderService.

### Acceptance Criteria
- [ ] GET /api/users/:id returns 404 for non-existent user
- [ ] Response body: `{ error: "user_not_found", userId: "<id>" }`
- [ ] Existing user tests still pass
- [ ] New test: "returns 404 for missing user"

### Notes
See OrderService.getOrder() for similar pattern.
Related: task-38 (added NotFoundError class)