Enhance 2FA handling and subuser session management

- Add `two_factor_enabled` property for subuser responses in routes and OpenAPI specs.
- Improve subuser session resolution by checking token `id` for validity.
- Adjust authentication flow to prevent operations on nonexistent users in 2FA logic.
- Update OpenAPI request/response schema to better represent token/session objects.

services/nginx/app/routes/authRoute.php

@@ -55,7 +55,7 @@ class authRoute
             }
             // If the credentials are valid, create a token
             $user = (new users_o())->getUserByCustomerNumber($data['customer_number']);
-            if ($user->isTwoFactorEnabled()) {
+            if ($user->exists() && $user->isTwoFactorEnabled()) {
                 $token = (new authentication())->create_2fa_token($user->id, '2FA_VERIFICATION_USER');
                 $response->success(['2fa_required' => true, '2fa_token' => $token]);
             }