Ensure uploaded zip is always removed after scan attempt

[JohnONolan]

Closes #519
Closes #521

Summary

• fix upload middleware cleanup flow so temporary uploaded files are removed even when gscan.checkZip(...) fails
• preserve the original scan error while still attempting cleanup
• ensure next(...) is called exactly once in all paths

Details

• store scan failure in checkError
• always run fs.remove(req.file.path) in .finally(...)
• if cleanup fails, log and continue (do not mask scan result)
• call next(checkError) on scan failure, otherwise call next()

Validation

• yarn test (includes posttest lint)
• result: 337 passing, coverage thresholds met

[coderabbitai]

Caution

Review failed

The pull request is closed.

Walkthrough

The POST / route handler in app/index.js was restructured to ensure uploaded files are cleaned up regardless of scan success or failure. A local variable captures errors from gscan.checkZip, while the promise chain now uses .catch() for error capture and .finally() for guaranteed cleanup. The uploaded file is always attempted to be removed, with removal errors logged. After cleanup, the error is conditionally forwarded to the next middleware if scanning failed, or execution continues normally on success.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

✨ Finishing Touches

• 📝 Generate docstrings (stacked PR)
• 📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch codex/fix-upload-cleanup-on-error

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}