Enhance 2FA handling and subuser session management

- Add `two_factor_enabled` property for subuser responses in routes and OpenAPI specs.
- Improve subuser session resolution by checking token `id` for validity.
- Adjust authentication flow to prevent operations on nonexistent users in 2FA logic.
- Update OpenAPI request/response schema to better represent token/session objects.

openapi.yaml

@@ -513,6 +513,9 @@ paths:
                       type: string
                       format: date-time
                       nullable: true
+                    two_factor_enabled:
+                      type: boolean
+                      description: Indicates if 2FA is enabled for this account
                     permissions:
                       type: array
                       description: Aggregated permission keys granted for the caller's customer
@@ -1277,14 +1280,19 @@ paths:
           content:
             application/json:
               schema:
-                type: object
-                properties:
-                  token:
-                    type: string
-                    description: Bearer authentication token (for users/employees)
-                  session:
-                    type: string
-                    description: Session token (for subusers)
+                oneOf:
+                  - type: object
+                    required: [token]
+                    properties:
+                      token:
+                        type: string
+                        description: Bearer authentication token (for users/employees)
+                  - type: object
+                    required: [session]
+                    properties:
+                      session:
+                        type: string
+                        description: Session token (for subusers)
         '400':
           $ref: '#/components/responses/BadRequest'
         '401':
@@ -7205,6 +7213,9 @@ components:
           type: string
           format: date-time
           nullable: true
+        two_factor_enabled:
+          type: boolean
+          description: Indicates if 2FA is enabled for this account
 
     PermissionNode:
       type: object