fix(#356): add session null-check to download endpoints

[Anirudh77715]

Download endpoints crashed with TypeError when no case session was set because None was passed to Path().

Linked issue

• Closes [Bug] Download endpoints crash with TypeError when no case session is set - None passed to Path() #356
• Related [Bug] ViewDataRoute endpoints allow unauthorized access and modification of cases due to missing session validation #347, [Bug] Missing session validation in file download routes causes 500 Internal Server Error #240

Existing related work reviewed

• Issues/PRs reviewed: [Bug] ViewDataRoute endpoints allow unauthorized access and modification of cases due to missing session validation #347, [Bug] deleteCase raises OSError causing HTML 500 response and session key is not properly cleared #345, [Bug] Missing session validation in file download routes causes 500 Internal Server Error #240
• No existing PR addresses the download endpoint crash

Overlap assessment

• Classification: none
• Overlapping items: [Bug] Missing session validation in file download routes causes 500 Internal Server Error #240 is a broader report with no PR
• Why this is not duplicate/superseded: this targets only the 5 download endpoints that crash when no case session is set; [Bug] Missing session validation in file download routes causes 500 Internal Server Error #240 is a broader tracking issue with no implementation

Why this PR should proceed

session.get('osycase', None) returns None → Path(None) raises TypeError → uncaught → HTML 500 for all download endpoints. This PR adds a session null-check guard returning a 400 JSON error instead.

Summary

• What changed: Added session null-check guard to 5 download endpoints in DataFileRoute.py and CaseRoute.py
• Why: Path(None) raises TypeError causing uncaught 500 errors on all download routes when no case session exists

Validation

• Tests added/updated (or not applicable)
• Validation steps documented
• Evidence attached (logs/screenshots/output as relevant)

Documentation

• Docs updated in this PR (or not applicable)
• Any setup/workflow changes reflected in repo docs

Scope check

• No unrelated refactors
• Implemented from a feature branch
• Change is deliverable without upstream OSeMOSYS/MUIO dependency
• Base repo/branch is EAPD-DRB/MUIOGO:main (not upstream)

Exception rationale

[SeaCelo]

@Anirudh77715 Thanks for the work here. I’m closing this in favor of #416, which we’re keeping as the current implementation PR for the missing-session download crash tracked under #240.