Bug: Backend accepts "undefined" string as valid username in `PATCH /users/self` endpoint

Issue Description

Currently in the signup flow at /new-signup, we take firstname and lastname inputs.
After submitting, we hit /username to generate a username. If this fails or errors, the frontend sends a request to update the profile with {"username": "undefined"}.
The backend endpoint PATCH /users/self accepts this body and updates the database with the string "undefined".

The proposed change will:

• Prevent the backend from accepting "undefined" as a username
• Return an error if this invalid data is sent

Expected Behaviour

• The backend should not update the database if username is "undefined"
• The API should return an error for this request

Current Behaviour

• The backend accepts "undefined" string
• The database is updated with "undefined" as the username

Reproducibility

• This issue is reproducible
• This issue is not reproducible

Severity/Priority

• Critical
• High
• Medium
• Low

Additional Information

• This happens during the onboarding flow.
• Endpoint: PATCH /users/self
• Requirement: Instead of a simple check for undefined, fix the root cause.

Screenshot

Checklist

• I have read and followed the project's code of conduct.
• I have searched for similar issues before creating this one.
• I have provided all the necessary information to understand and reproduce the issue.
• I am willing to contribute to the resolution of this issue.

Start by tracing the PATCH /users/self handler and the /new-signup to /username flow described in the issue. Identify why the onboarding request can send the literal "undefined" string, then verify that invalid input returns an error without updating the database. Reproduce the request and run the relevant backend tests, if available.