Look at line 354: `if (req.user.role !== 'super_admin' && rows[0].tenant_id !== req.user.tenant_id) {`
What if `req.user.tenant_id` is null (which it is for some system admins)?
But `rows[0].tenant_id` could be something else. That just returns 403.
What if `rows` is empty?
Line 353: `if (rows.length === 0) return res.status(404).json({ error: 'Not found' });`
What if `req.user` is undefined? (Should be caught by middleware).

Wait, the user says the error is:
`https://fasto.blyzer.com.br/api/users/u_71657ec7`
And it returns `500`.

Let's log the exact error inside the catch block in the backend.