fix(backend): scope document access, add admin users and API keys

[RUKAYAT-CODER]

Summary

Small backend changes covering the four assigned issues:

• Scope the risk-assessment listing to the caller and move it off /documents/:id so it can no longer be shadowed (GET /documents/risk-assessments returns every user's documents and can be shadowed by GET /documents/:id #1474)
• Add owner/admin checks and UUID validation to the document verification routes (POST /documents/:id/verify and GET /documents/:id/verification have no ownership check #1472)
• Add admin-only user list, role change and delete endpoints with last-admin protection and access-log entries (Implement admin user management endpoints (list, change role, delete) used by the admin UI #1471)
• Add per-user API key create/list/revoke endpoints and API-key authentication for selected routes (Implement per-user API keys (GET/POST/DELETE /users/me/api-keys) and an API-key auth strategy #1470)

Closes #1474
Closes #1472
Closes #1471
Closes #1470

[vercel]

@RUKAYAT-CODER is attempting to deploy a commit to the Mftee's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@RUKAYAT-CODER Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits