- Add `two_factor_enabled` property for subuser responses in routes and OpenAPI specs. - Improve subuser session resolution by checking token `id` for validity. - Adjust authentication flow to prevent operations on nonexistent users in 2FA logic. - Update OpenAPI request/response schema to better represent token/session objects.