fix(server): unify profile image errors to prevent user-existence oracle via status code

GET /users/:id/profile-image returned HTTP 400 for an unknown user ID
but HTTP 404 when the user existed without a photo, letting callers
distinguish the two cases. Both now return 404 so the response is
identical regardless of whether the UUID maps to an account.

server/src/services/user.service.spec.ts

@@ -179,7 +179,7 @@ describe(UserService.name, () => {
     it('should throw an error if the user does not exist', async () => {
       mocks.user.get.mockResolvedValue(void 0);
 
-      await expect(sut.getProfileImage(userStub.admin.id)).rejects.toBeInstanceOf(BadRequestException);
+      await expect(sut.getProfileImage(userStub.admin.id)).rejects.toBeInstanceOf(NotFoundException);
 
       expect(mocks.user.get).toHaveBeenCalledWith(userStub.admin.id, {});
     });

server/src/services/user.service.ts

@@ -134,8 +134,8 @@ export class UserService extends BaseService {
   }
 
   async getProfileImage(id: string): Promise<ImmichFileResponse> {
-    const user = await this.findOrFail(id, {});
-    if (!user.profileImagePath) {
+    const user = await this.userRepository.get(id, {});
+    if (!user || !user.profileImagePath) {
       throw new NotFoundException('Not found');
     }