fix(cli): check app exists before uploading bundle

[posthog-eu]

Summary

• A first bundle upload to an app that was never registered uploaded the whole bundle before failing, then surfaced a raw tus app_not_found 404 (and, on the delta path, an unhandled rejection) instead of the CLI's own app add guidance — a confusing dead end on the exact activation moment a new user decides whether Capgo works.
• Root cause: the app-existence/permission gate (checkAppExistsAndHasPermissionOrgErr) ran after the TUS uploads. For an unknown app the files backend rejects the upload with 404 app_not_found (supabase/functions/_backend/files/files.ts), and the partial path re-threw the raw tus error object, escaping as an unhandled rejection.
• Fix: move the check before any bytes are sent, so an unregistered app fails fast with the existing hint (run first `npx @capgo/cli app add <id>` ). As defense-in-depth, both tus onError handlers now map app_not_found onto the same hint, thrown as an expected user error.

	Before	After
Unregistered app, full upload	whole bundle uploads → raw app_not_found 404	fails before upload with app add hint
Unregistered app, delta upload	raw tus error → unhandled rejection in error tracking	expected user error with app add hint

Note: getOrganizationId already ran before the uploads and would throw a generic Cannot get organization id for app id <id> for a truly nonexistent app — so the earlier check also replaces that unclear message with the actionable one. The tus-handler mapping covers the remaining races (e.g. app deleted mid-flight) where the backend still returns app_not_found.

Same pattern as #2896 and #2885. No open PR touches these paths.

Test plan

• bun run typecheck, bun run lint:ox (both pass), and bun run test:upload (passes).
• Manual: run bundle upload <unregistered-app-id> and confirm it errors immediately with the app add hint and sends no bundle bytes.

Screenshots

N/A — CLI error-message change only.

Checklist

• My code follows the code style of this project and passes
  bun run lint:backend && bun run lint.
• My change requires a change to the documentation.
• I have updated the documentation
  accordingly.
• My change has adequate E2E test coverage.
• I have tested my code manually, and I have provided steps how to reproduce
  my tests

---

Created with PostHog Desktop from this inbox report.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[codspeed-hq]

Merging this PR will not alter performance

✅ 43 untouched benchmarks
⏩ 2 skipped benchmarks¹

---

_{Comparing posthog-self-driving/fixcli-check-app-exists-before-73ed51 (22452a7) with main (0fdf275)²}

Footnotes

1. 2 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

2. No successful run was found on main (0c456b2) during the generation of this report, so 0fdf275 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud