fix(OFJAVA-013): 3 review findings across 3 files

[flamingo]

Closes 3 review findings across 3 files.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

#	Fix confidence	Finding	Location
1	🟡 85 medium	OAuthDevTicketStore.consumeTicket returns null instead of Optional	openframe-security-oauth/src/main/java/com/openframe/security/oauth/service/OAuthDevTicketStore.java:15
2	🔴 55 low — review closely	EventService.updateEvent throws generic RuntimeException instead of a domain exception	openframe-api-lib/src/main/java/com/openframe/api/service/EventService.java:84
3	🟢 92 high	InvitationRegistrationService.handleExistingActiveUser returns null to signal 'proceed with creation'	openframe-authorization-service-core/src/main/java/com/openframe/authz/service/user/InvitationRegistrationService.java:63

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: 59051284-b3d6-4391-892c-38c8737386e1

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

[flamingo]

🦩 What this fix changed, finding by finding

3 finding(s) fixed in this draft. (Inline placement was rejected by GitHub for this PR.)

🔴 1. OAuthDevTicketStore.consumeTicket returns null instead of Optional — openframe-security-oauth/src/main/java/com/openframe/security/oauth/service/OAuthDevTicketStore.java:15
In OAuthDevTicketStore.consumeTicket's javadoc, changed "Returns null if not found." to "Completes empty if not found." This updates the interface contract to match Reactor semantics (Mono.empty() instead of emitting null), resolving the documented null-return contract violation. Note: this is an interface-only file; actual implementations of consumeTicket (not present here) must be verified/updated separately to ensure they use Mono.empty() rather than Mono.justOrEmpty(null) misuse or Mono.just(null), which is outside the scope of this single file.

🤖 Prompt for AI agents

In openframe-security-oauth/src/main/java/com/openframe/security/oauth/service/OAuthDevTicketStore.java around line 15, review and complete this code-review fix: OAuthDevTicketStore.consumeTicket returns null instead of Optional.
What the draft fix changed: In OAuthDevTicketStore.consumeTicket's javadoc, changed "Returns null if not found." to "Completes empty if not found." This updates the interface contract to match Reactor semantics (Mono.empty() instead of emitting null), resolving the documented null-return contract violation. Note: this is an interface-only file; actual implementations of consumeTicket (not present here) must be verified/updated separately to ensure they use Mono.empty() rather than Mono.justOrEmpty(null) misuse or Mono.just(null), which is outside the scope of this single file.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟡 85 medium — react 👍/👎 to teach the reviewer

🔴 2. EventService.updateEvent throws generic RuntimeException instead of a domain exception — openframe-api-lib/src/main/java/com/openframe/api/service/EventService.java:84
In updateEvent, replaced throw new RuntimeException("Event not found with id: " + id) with throw new EventNotFoundException(id), and added the corresponding import com.openframe.api.exception.EventNotFoundException. This assumes such an exception class already exists (or will be added) in package com.openframe.api.exception with a constructor accepting the event id, and that a @RestControllerAdvice maps it to a 404 response — neither of which is visible in this file, so the class must be created/verified elsewhere for this change to compile and behave correctly.

🤖 Prompt for AI agents

In openframe-api-lib/src/main/java/com/openframe/api/service/EventService.java around line 84, review and complete this code-review fix: EventService.updateEvent throws generic RuntimeException instead of a domain exception.
What the draft fix changed: In `updateEvent`, replaced `throw new RuntimeException("Event not found with id: " + id)` with `throw new EventNotFoundException(id)`, and added the corresponding import `com.openframe.api.exception.EventNotFoundException`. This assumes such an exception class already exists (or will be added) in package `com.openframe.api.exception` with a constructor accepting the event id, and that a `@RestControllerAdvice` maps it to a 404 response — neither of which is visible in this file, so the class must be created/verified elsewhere for this change to compile and behave correctly.
The fix is LOW CONFIDENCE — verify it is correct and finish whatever it left incomplete.

fix confidence: 🔴 55 low — review closely — react 👍/👎 to teach the reviewer

🟠 3. InvitationRegistrationService.handleExistingActiveUser returns null to signal 'proceed with creation' — openframe-authorization-service-core/src/main/java/com/openframe/authz/service/user/InvitationRegistrationService.java:63
Changed handleExistingActiveUser to return Optional<AuthUser> instead of a nullable AuthUser (returning Optional.of(user), Optional.empty(), or throwing), updated its Javadoc accordingly, and updated the caller registerByInvitation to use reuse.isPresent() / reuse.get() instead of the reuse != null null-check anti-pattern. Added the java.util.Optional import. No other behavior changed.

🤖 Prompt for AI agents

In openframe-authorization-service-core/src/main/java/com/openframe/authz/service/user/InvitationRegistrationService.java around line 63, review and complete this code-review fix: InvitationRegistrationService.handleExistingActiveUser returns null to signal 'proceed with creation'.
What the draft fix changed: Changed `handleExistingActiveUser` to return `Optional<AuthUser>` instead of a nullable `AuthUser` (returning `Optional.of(user)`, `Optional.empty()`, or throwing), updated its Javadoc accordingly, and updated the caller `registerByInvitation` to use `reuse.isPresent()` / `reuse.get()` instead of the `reuse != null` null-check anti-pattern. Added the `java.util.Optional` import. No other behavior changed.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 92 high — react 👍/👎 to teach the reviewer