fix(api): close the user data export reader after download

DownloadUserDataExport obtained an open file reader from
GetUserDataExportFile but never closed it on either the s3 io.Copy or the
http.ServeContent branch, leaking a file descriptor on every download.
Defer the close right after the file is obtained so both branches and the
error paths cover it.

pkg/routes/api/v1/user_export.go

@@ -131,6 +131,7 @@ func DownloadUserDataExport(c *echo.Context) error {
 		}
 		return err
 	}
+	defer func() { _ = exportFile.File.Close() }()
 
 	// Downloads must never be cached; no-cache overrides the global no-store
 	// directive while still allowing revalidation.