fix(backend): owner-scoped risk reads, sessions/2FA, and lint cleanup

[walexjnr]

Summary

Small backend changes covering the four assigned issues:

• Make GET /documents/:id/risk read the stored score without writing, enforce ownership and add an explicit POST /documents/:id/risk/reassess (GET /documents/:id/risk has no ownership check and mutates data on a GET #1473)
• Add persisted refresh sessions, session listing/revocation and change-password (Implement change-password and session management endpoints (list sessions, revoke a session) #1467)
• Add TOTP 2FA setup, verification, login challenge, backup codes and disable endpoints (Implement two-factor authentication endpoints (setup, verify, challenge, disable) #1466)
• Fix the reported lint issues: unused imports, require() imports, the merged CORS spec, and remove --fix from the lint script (Backend lint has many non-syntax errors on main: unused imports and variables, require() imports, and a merged spec file #1458)

Closes #1473
Closes #1467
Closes #1466
Closes #1458

[vercel]

@walexjnr is attempting to deploy a commit to the Mftee's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@walexjnr Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits